CVE-2026-119734

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119734 Munshi IDOR via Purchase Inquiry Thread Endpoint

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

EUVD-2026-115365

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119734

The Munshi platform (by Petpooja ) versions released before 2026-06-17 is affected by a broken object level authorization (IDOR) vulnerability. The flaw exists in the GET /purchase-inquiry/thread/{thread-id} endpoint, where authenticated attackers can manipulate the thread identifier to access da...

CVE-2026-119734: Petpooja Munshi: Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows…

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

Joomla! Component Percha Fields Attach 1.0 - Directory Traversal

A directory traversal vulnerability in the Percha Fields Attach comperchafieldsattach component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-2036 info: name:...

CVE-2026-115709

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack CAPEC-132...

PaperCut < 22.1.3 - Path Traversal

PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files. id: CVE-2023-39143 info: name: PaperCut 22.1.3 - Path Traversal author: pdteam severity: critical description: PaperCut NG and PaperCut MF before 22.1.3...

CVE-2026-116492

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the getcontactbyphonenumber API, which performs raw database queries without invoking the permission...

CVE-2026-116492 Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the getcontactbyphonenumber API, which performs raw database queries without invoking the permission...

CVE-2026-116492 Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the getcontactbyphonenumber API, which performs raw database queries without invoking the permission...

CVE-2026-116492

The Frappe CRM app version prior to 1.89.1 is vulnerable to a missing authorization issue (CWE-862). The crm.integrations.api.get_contact_by_phone_number endpoint performs raw database queries without invoking the application's permission system. This allows authenticated low-privileged users to ...

EUVD-2026-109789

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the getcontactbyphonenumber API, which performs raw database queries without invoking the permission...

CVE-2026-116469

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions checkrequiredtaxonomyexists, checkrequiredtaxonomytagsallowed, checkblockedattributecategories, and checkblockedanalystdatasharinggroupsuuids...

CVE-2026-116469 MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions checkrequiredtaxonomyexists, checkrequiredtaxonomytagsallowed, checkblockedattributecategories, and checkblockedanalystdatasharinggroupsuuids...

EUVD-2026-109736

MISP Guard, a proxy-based security filter for MISP Malware Information Sharing Platform feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions checkrequiredtaxonomyexists, checkrequiredtaxonomytagsallowed, checkblockedattributecategories, and...

CVE-2026-116469

The MISP Guard security filter contains a case-sensitivity flaw in several policy enforcement functions, including check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids. Because these functions...

CVE-2026-116469

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions checkrequiredtaxonomyexists, checkrequiredtaxonomytagsallowed, checkblockedattributecategories, and checkblockedanalystdatasharinggroupsuuids...

PT-2026-123339

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get contact by phone number API, which performs raw database queries without invoking the permission...

PT-2026-123278

MISP Guard, a proxy-based security filter for MISP Malware Information Sharing Platform feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check required taxonomy exists, check required taxonomy tags allowed, check blocked attribute categories...