CVE-2026-55482

Snipe-IT , a Laravel-based IT asset and license management system, is affected by an authorization bypass in the BulkAssetsController::update() method. The method accepts the company_id parameter directly from user input without invoking Company::getIdForCurrentUser(), the standard company-scopin...

CVE-2026-19539

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content title, description, and attachments of tickets belonging to another company, to hijack another company's...