600714 matches found
CVE-2026-55694 Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/targetid/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/filename. The primary /stored-eula-file/filename rout...
EUVD-2026-62628
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...
CVE-2026-55643 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...
CVE-2026-55643 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...
EUVD-2026-62627
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...
CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...
CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...
CVE-2026-55703
Snipe-IT (IT asset/license management system) prior to 8.6.3 contains an authorization bypass in MaintenancesController::show(). The method renders a maintenance record without calling authorize(), unlike all sibling actions (index, edit, update, destroy) which properly gate on the asset. Any act...
EUVD-2026-62682
Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers th...
CVE-2026-55519 Snipe-IT: Improper Authorization in File Deletion (IDOR)
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...
EUVD-2026-62680
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...
CVE-2026-73136
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...
CVE-2026-73829
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
CVE-2026-66794
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
CVE-2025-14600
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...
CVE-2026-60798
creationtimestamp| type| source ---|---|--- 2026-08-19 18:16:02+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-61321
creationtimestamp| type| source ---|---|--- 2026-08-19 18:15:48+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2020-37267
A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. An attacker with access to these logs could obtain the bot's...