CVE-2026-88860 Capgo Authorization Bypass via Stale Channel Permission Overrides

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

CVE-2026-88860

Capgo , an OTA update platform, is affected by an authorization bypass caused by stale channel permission overrides. When a user's last organization role binding is deleted, Capgo fails to clean up associated channel-level permission overrides, leaving them active. An attacker with a previously r...

mvt v2026.9.7

Mobile Verification Toolkit !IMPORTANT We recently merged the "v3" branch. This introduced breaking changes. If you relied on mvt output in other scripts They might have broken. More details: https://github.com/mvt-project/mvt/issues/757 Mobile Verification Toolkit MVT is a collection of utilitie...

CVE-2026-86494

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86482

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation...

CVE-2026-86494

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86494

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86494

In JetBrains YouTrack versions prior to 2026.2.18634 , cloning a whiteboard allowed an attacker with low privileges to make unauthorized changes to links on issues they could not otherwise access. The vulnerability is rated CVSS 7.7 (High) with changed scope and high integrity impact , requiring ...

CVE-2026-86482

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation...

CVE-2026-86482

JetBrains YouTrack prior to version 2026.2.18634 is affected by a privilege escalation vulnerability caused by unchecked group membership changes , allowing a low-privileged user to escalate their permissions. The flaw is exploitable over the network with low attack complexity and no user interac...

CVE-2026-86482

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation...

EUVD-2026-72498

In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation...

PT-2026-86854

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18634 Description Insufficient validation of role assignments allows for privilege escalation, where a user can gain higher access levels than intended. Recommendations Update to version 2026.2.18634...

CVE-2026-86091

creationtimestamp| type| source ---|---|--- 2026-09-06 06:11:54+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutdkg5dke2l 2026-09-06 07:07:56+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutgolfbcq2x 2026-09-09 11:50:24+00:00| seen|...

CVE-2026-85669

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

EUVD-2026-71125

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85669

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying conversation IDs, resulting in unauthorized modification of pending co...

CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...