CVE-2026-76901: Authorization Bypass Through User-Controlled Key

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/id in PoolClueController.get and GET /pool/account/get/id in PoolCustomerController.get use bare pool-read permission checks without the CsPermission...

PT-2014-8614

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.18 Description The issue allows remote attackers to obtain sensitive information. This can be achieved via specific SOAP requests, including mc project get users, mc issue get, mc filter get issues, or mc project...