EUVD-2026-38636

Fortra File Integrity Monitoring FIM, formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission...

CVE-2026-12164

creationtimestamp| type| source ---|---|--- 2026-06-24 00:05:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moymkmpneg2f...

CVE-2026-54518

creationtimestamp| type| source ---|---|--- 2026-06-24 00:02:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moymgidgrg2f...

CVE-2026-50193

creationtimestamp| type| source ---|---|--- 2026-06-23 23:51:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moylsm4iin2j...

Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

Impact The store method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges. Th...

GHSA-HF68-G98V-WP9G Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

Impact The store method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges. Th...

CVE-2026-49205

creationtimestamp| type| source ---|---|--- 2026-06-23 22:42:14+00:00| seen| https://gist.github.com/alon710/b22b0dd984dd927be769bc999880e7f3...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization in the API endpoints responsible for category creation, FAQ creation, FAQ updating, and question creation due to missing permissio...

CVE-2025-64105

FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 through 0.7.2 are vulnerable to IDOR through the support ticket creation workflow. By manipulating relid when reltype=order, an authenticated...

CVE-2026-24887

creationtimestamp| type| source ---|---|--- 2026-06-23 21:00:12+00:00| seen| https://gist.github.com/NikosRig/b4330ceb780fe22bf3c14f38d7d90795...

CVE-2026-47375

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT.... The value is unrestricted by formula...

EUVD-2026-38628

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT.... The value is unrestricted by formula...

CVE-2026-47375 NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT.... The value is unrestricted by formula...

CVE-2020-9713

creationtimestamp| type| source ---|---|--- 2026-06-23 20:35:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyatekhrg2l...

CVE-2026-54321

creationtimestamp| type| source ---|---|--- 2026-06-23 20:28:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyagoino72a...

EUVD-2026-38616

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific...

CVE-2026-54320

creationtimestamp| type| source ---|---|--- 2026-06-23 20:08:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7cs26fp2f...

CVE-2025-64105 FOSSBilling: IDOR Vulnerability in Support Ticket Creation

FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 through 0.7.2 are vulnerable to IDOR through the support ticket creation workflow. By manipulating relid when reltype=order, an authenticated...

CVE-2025-64105

Summary: FOSSBilling

CVE-2025-64105 FOSSBilling: IDOR Vulnerability in Support Ticket Creation

FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 through 0.7.2 are vulnerable to IDOR through the support ticket creation workflow. By manipulating relid when reltype=order, an authenticated...