CVE-2026-15191

CVE-2026-15191 affects mettle sendportal up to 3.0.1, specifically the CampaignCreation Endpoint logic in vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php. The flaw enables authorization bypass via manipulation of the Campaign Creation Endpoint. It is a remote network-expo...

CVE-2026-15191

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack c...

GHSA-C43V-4CR8-6MVP

creationtimestamp| type| source ---|---|--- 2026-07-09 15:42:12+00:00| seen| https://gist.github.com/alon710/ffb181b33bedea772189a8193fac5697...

CVE-2026-61474

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharinggroupid without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly s...

EUVD-2026-42601

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharinggroupid without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly s...

CVE-2026-61474 MISP: Improper sharing group authorization check when adding attributes

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharinggroupid without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly s...

CVE-2026-61474

CVE-2026-61474 concerns MISP’s attribute creation endpoint. A faulty authorization check allowed an authenticated user with permission to add attributes to submit a non-empty sharing_group_id without triggering the sharing group authorization check, unless the distribution value was explicitly se...

CVE-2026-61474 MISP: Improper sharing group authorization check when adding attributes

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharinggroupid without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly s...

CVE-2026-56292

creationtimestamp| type| source ---|---|--- 2026-07-09 14:37:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7ucjr7o52t 2026-07-09 17:34:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqa65xtg2r2z 2026-07-11 03:07:06+00:00| seen|...

CVE-2026-15163

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u64nhfe25...

CVE-2026-8472

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u5w5rz72o 2026-07-10 17:44:35+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqcp7nooid2k 2026-07-10 17:44:39+00:00| seen|...

CVE-2017-2850

creationtimestamp| type| source ---|---|--- 2026-07-09 14:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7slsxo272m...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via unsanitized input in the slug field during the export process. An attacker can cause arbitrary files and directories to be created or overwritten outside the intended export directory by submitting specially...

CVE-2026-12593

The implementation of an internal and undocumented Dashboard API endpoint POST /api/users//user/tokens forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user with more...

CVE-2026-12593

The CVE concerns Axivion Dashboard’s OIDC/OAuth2/SSO subsystem. An internal, undocumented API endpoint (POST /api/users/~/{user}/tokens) did not enforce sufficient permissions when creating an API token for another user. Preconditions include an internal user with higher privileges, knowledge of ...

CVE-2026-12593 Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem

The implementation of an internal and undocumented Dashboard API endpoint POST /api/users//user/tokens forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user with more...

EUVD-2026-42589

The implementation of an internal and undocumented Dashboard API endpoint POST /api/users//user/tokens forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user with more...

CVE-2026-9240

creationtimestamp| type| source ---|---|--- 2026-07-09 12:27:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7mz2x7ed27...

CVE-2026-9027

creationtimestamp| type| source ---|---|--- 2026-07-09 12:07:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7lvw6qiq25...

CVE-2026-9253

creationtimestamp| type| source ---|---|--- 2026-07-09 11:54:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7l5x5fd325 2026-07-09 13:30:51+00:00| seen| https://infosec.exchange/users/offseq/statuses/116890261952553944 2026-07-09 13:30:53+00:00| seen|...