PT-2026-79579

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description The form.inlineedit form controller fails to perform necessary access checks, which allows unauthenticated users to disclose rows of data. Recommendations Update to version 4.7.2 or later...

PT-2026-79585

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An issue exists where the 'onUpdateComment' endpoint does not perform necessary access checks, allowing unauthenticated users to modify any comment. Recommendations Update to version 4.7.2 or later...

CVE-2026-76601: Improper Access Control

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-76609: Improper Access Control

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-34948

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34949 Combodo iTop: Unauthenticated user can delete .readonly file

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3...

EUVD-2026-64187

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948

Combodo iTop versions prior to 3.2.3 are affected by an access control bypass in its OQL (Object Query Language) engine. The root cause is that the silos access check only applies to classes present in the SELECT clause , leaving classes referenced via JOINs unprotected. This allows an authentica...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-34836

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

CVE-2026-34836 Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

CVE-2026-34836

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

CVE-2026-34836

Combodo iTop versions prior to 3.2.3 contain an improper access control vulnerability in ajax.render.php and ajax.document.php. The flaw allows authenticated users to access documents without proper permission checks, resulting in high confidentiality impact (CVSS 3.1: 6.5 MEDIUM ). The attack re...

CVE-2026-34836 Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

EUVD-2026-64184

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

CVE-2026-34836 Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...