MINI-XPPJ-GM2M-WMHW

Bulletin has no description...

ANT-2026-BTRNT5A3 · supabase/supabase · broken-access-control

broken-access-control high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-BTRNT5A3: Server action accepts client-controlled CRM backend targets submitFormAction is exporte...

EUVD-2026-60546

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

EUVD-2026-60541

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

EUVD-2026-60478

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

SUSE CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

SUSE CVE-2026-70452

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the ru...

PT-2026-77146

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

PT-2026-77205

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4 Description Backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The 'admin/controller/content/revisions.php' controller and 'admin/sql/sqlite/pos...

PT-2026-77187

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradmin id t...

PT-2026-77189

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

PT-2026-77048

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

PT-2026-77122

Name of the Vulnerable Software and Affected Versions Charitable versions prior to 1.8.11.4 Description An unauthenticated broken access control issue exists, allowing network exploitation without requiring user interaction. Recommendations Update to a version newer than 1.8.11.3...

PT-2026-77076

Name of the Vulnerable Software and Affected Versions Appointment Hour Booking versions prior to 1.5.92 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 1.5.91...

PT-2026-77893

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description An issue exists in the Access and security component that allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-77186

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.p...

PT-2026-78241

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.9 Description An issue exists where any authenticated user can enumerate account information for all users and retrieve arbitrary account details. This occurs because the users/index and users/show actions rely...

PT-2026-77312

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.1 Description A schema validation bypass occurs when a request body schema targets a root primitive value. When validating a top-level primitive, such as an integer, Ajv a JSON schema validator may coerce a JSON...

PT-2026-77633

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Customer Care versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Customer Care allows a high privileged attacker with network access via HTTP to compromise the syste...

CVE-2026-52608

reportico-web versions up to 8.1.0 have an incorrect access control flaw allowing unauthenticated attackers to inject arbitrary PHP into any report's PreExecuteCode attribute, bypassing safe_mode, leading to remote code execution. No patch version or in-the-wild exploitation details are provided ...