Improper Authorization

Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to improper enforcement of company boundary validation when creating locations, where an invalid parent-child company relationship is detected but not blocked, allowing authenticated users to create child locations under...

GHSA-PG7V-JWJ7-P798

creationtimestamp| type| source ---|---|--- 2026-07-21 08:31:39+00:00| seen| https://gist.github.com/alon710/afd430e951c08264a9a3f3da451132a3...

GHSA-VJC4-5QP5-M44J

creationtimestamp| type| source ---|---|--- 2026-07-21 07:31:35+00:00| seen| https://gist.github.com/alon710/796ee0a4078a7a835fdac3bedcdff5ad...

GHSA-9HW9-CH79-4VH6

creationtimestamp| type| source ---|---|--- 2026-07-21 06:31:17+00:00| seen| https://gist.github.com/alon710/c194376028b5fea9d1333b8a7894f724...

CVE-2023-37508

creationtimestamp| type| source ---|---|--- 2026-07-21 06:17:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr55wd6qbu27...

CVE-2026-63729

creationtimestamp| type| source ---|---|--- 2026-07-21 06:12:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr55nepsvl2q...

GHSA-V422-HMWV-36X6

creationtimestamp| type| source ---|---|--- 2026-07-21 05:31:05+00:00| seen| https://gist.github.com/alon710/b2e2ae2f4c7c5ec01435305f8e986e39...

CVE-2026-59776

creationtimestamp| type| source ---|---|--- 2026-07-21 04:45:05+00:00| seen| https://jvn.jp/en/jp/JVN40509781 2026-07-21 05:57:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr54trr3hu23 2026-07-21 08:15:05+00:00| seen|...

GHSA-HP3V-MFQW-H74C

creationtimestamp| type| source ---|---|--- 2026-07-21 04:31:23+00:00| seen| https://gist.github.com/alon710/108624152e69003362bd827cbabc8c78...

CVE-2026-16330

creationtimestamp| type| source ---|---|--- 2026-07-21 02:53:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4sl7xhkx2x...

CVE-2026-63728

creationtimestamp| type| source ---|---|--- 2026-07-21 02:48:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4scbfod72b...

CVE-2026-55831

creationtimestamp| type| source ---|---|--- 2026-07-21 02:38:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4rqebgbg2x 2026-07-22 22:35:24+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w 2026-08-10 13:20:13+00:00| seen|...

GHSA-F283-GHQC-FG79

creationtimestamp| type| source ---|---|--- 2026-07-21 02:31:08+00:00| seen| https://gist.github.com/alon710/2702abf20f9326c55748b684ae709cc9...

CVE-2026-48349

creationtimestamp| type| source ---|---|--- 2026-07-21 00:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr4kwieey42l...

PT-2026-63080

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 12.2.1.4.0 Oracle Identity Manager versions 14.1.2.1.0 Description A flaw in the OIM Legacy UI component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise...

PT-2026-65345

Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoint only verifies that the user is an...

PT-2026-62060

Name of the Vulnerable Software and Affected Versions Data::ReqRep::Shared versions prior to 0.05 Description This issue occurs when the software creates a world-readable mmap backing file and opens it without using O EXCL or O NOFOLLOW. The segment is created in reqrep.h using the open function...

CVE-2026-47237: Incorrect Privilege Assignment

Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the...

PT-2026-63283

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A privilege escalation issue exists in the API endpoint POST /users/username/tokens used for creating Personal Access Tokens. The endpoint is protected by the reqBasicOrRevProxyAuth middleware,...

CVE-2026-28309: Missing Authorization

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments...