CVE-2026-19433

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-72759

CVE-2026-72759 affects MISP cti-transmute. The vulnerability lies in the conversion-history details endpoint, where an incomplete authorization check allows disclosure when a history entry references a deleted conversion. If the conversion lookup returns None, access was not properly denied; as a...

CVE-2026-19433

CVE-2026-19433 affects the Roskus Prospero Flow CRM contact management component (pre-5.4.8). The root cause is that save and export operations retrieve the contact record without constraining the query to the authenticated user’s company, enabling an authenticated user from any company to overwr...

EUVD-2026-55634

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

CVE-2026-19433 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

CVE-2026-71959 Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log...

CVE-2026-72690 Attendize Attendize - Cross-Tenant Authorization Bypass

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

CVE-2026-72585

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...

CVE-2026-72585

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

CVE-2026-72585

Summary: CVE-2026-72585 affects Grafana up to version 13.2.0. An Editor-role user can delete protected contact points (receivers) because the DELETE path in receiver services was not updated with the protected-field check, even though CVE-2026-21724’s fix addressed only the UPDATE code path in th...

EUVD-2026-55221

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

CVE-2026-72585

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

CVE-2026-21062

Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data...

EUVD-2026-55087

Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data...

CVE-2026-21062

Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data...

CVE-2026-21062

Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data...

CVE-2026-21062

CVE-2026-21062 describes an authorization bypass in SemClipboardService prior to the SMR Aug-2026 Release 1. The issue allows local attackers to access clipboard data. Documents do not provide details on the vulnerable component version ranges beyond the release qualifier, nor on a concrete root ...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, authorization based on the "domain=" path parameter was checked before the final file could be opened or used. A symlink swap was used to bypass the policy-deni...