CVE-2026-93547

The Vaadin Spreadsheet component (including the Spreadsheet add-on for Vaadin Framework 7 and 8) contains a missing authorization check that allows authenticated users to add or replace cell comments on sheets with enabled protection, including locked cells. The underlying cause is that the handl...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

PT-2026-103275

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547: Improper Authorization

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-100268: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates...

PT-2026-103325

🚨 CVE-2026-100278 In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments 🎖@cveNotify...

CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

CVE-2026-100672

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

EUVD-2026-87672

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

CVE-2026-100672

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100672

The Comments plugin (getgrav/grav-plugin-comments ) for Grav CMS through version 1.2.10 contains an authentication bypass that allows for unauthenticated information disclosure . The root cause is an admin handler that incorrectly uses the isAdmin() function, which only verifies if the admin serv...

EUVD-2026-87766

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100672: Missing Authentication for Critical Function

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

PT-2026-99343

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-comments versions prior to 1.2.11 Description The Comments plugin for Grav CMS registers an admin handler that returns comment data as JSON without performing an authentication check. The handler relies on the isAdmin...

CVE-2026-55217

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0...

CVE-2026-55217

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0...

EUVD-2026-87280

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0...

CVE-2026-92597

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to bypass email domain validation due to incorrect parsing of RFC 5322 comments in email addresses. Specifically, a malformed comment can cause Nodemailer to misinterpret the recipient's domain, leading to the delivery of...