87367 matches found
PT-2026-89016
Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unaccepted assets/sent reminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unaccepted assets/acceptanceId/delete...
CVE-2026-15913: Relative Path Traversal
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...
PT-2026-89080
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges...
CVE-2026-48707
InstantCMS versions prior to 2.18.2 contain a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php, lines 509–532). When the "upload from URL" feature follows an HTTP redirect , the redirected target URL bypasses the private IP address blackl...
EUVD-2026-72866
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...
CVE-2026-86726 AVideo through 29.0 Information Disclosure via restreamsActive.json.php
AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive...
CMP WordPress < 4.0.19 - Broken Access Control
CMP WordPress plugin 4.0.19 contains an arbitrary page layout change caused by insufficient access control in the coming soon page feature, letting unauthenticated users modify the layout, exploit requires no authentication. id: CVE-2022-0188 info: name: CMP WordPress 4.0.19 - Broken Access Contr...
CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...
CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...
CVE-2026-86720: Authorization Bypass Through User-Controlled Key
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...
CVE-2026-86493
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...
CVE-2026-86493
JetBrains YouTrack versions before 2026.2.18634 contained improper permission checks that allowed read-only users to create and modify whiteboard cards . This represents an authorization bypass with an integrity impact — a user granted only read access could alter content without being permitted ...
EUVD-2026-72509
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...
CVE-2026-86493
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...
CVE-2026-86487
In JetBrains YouTrack versions before 2026.2.18634 , a crafted WebSocket message allowed read-only whiteboard users to modify canvas content. The flaw is an integrity issue: users who should have had read-only access could alter whiteboard drawings. The CVSS 3.1 score is 3.1 (LOW) , reflecting a ...
EUVD-2026-72396
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...
CVE-2026-86441
MISP (≤2.5.45) contains inconsistent authorization checks in organisation-related dashboard widgets. Several widgets failed to honor the Security.hide_organisation_index_from_users setting, allowing authenticated users lacking the perm_sharing_group permission to enumerate organisations despite t...
CVE-2026-19633
A flaw was found in PostgreSQL Anonymizer. This vulnerability allows unprivileged masked users to execute arbitrary code. By manipulating operators, domain casts, or view subqueries that contain untrusted expressions, an attacker can cause malicious code to run with elevated privileges within the...
CVE-2026-84256
A flaw was found in OpenVPN on Windows. An argument parsing issue allows remote authenticated users to execute arbitrary commands by providing a specially crafted certificate subject. This vulnerability could lead to a complete compromise of the affected system...