CVE-2026-67347 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

EUVD-2026-51150

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

PT-2026-64763

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.26.2 Description An authentication bypass exists in the console registration API. Unauthenticated attackers can update existing console assets by providing a known asset identifier. This allows the overwriting of...

CVE-2026-55469 Snipe-IT: Path traversal vulnerability via CSV import `image` field

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the...

GHSA-33G4-646G-QWMM Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

Impact The BulkAssetsController::update method accepts companyid directly from user input without calling Company::getIdForCurrentUser, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking...

EUVD-2020-5593

Malware in sbrugna...

UBUNTU-CVE-2020-13333

A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage...

PT-2020-13474 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.1 through 13.3 Description: A potential DOS issue was discovered. The API to update an asset as a link from a release had a regex check which caused an exponential number of backtracks for certain user-supplied values,...