24821 matches found
CVE-2026-19539
CVE-2026-19539 affects Roskus Prospero Flow CRM prior to 5.4.9. It is an IDOR where an authenticated user can read full ticket content, hijack tickets by reassigning company_id, and delete tickets belonging to other companies. Root cause: read/save paths do not constrain queries to the user’s com...
CVE-2026-72775 n8n before 1.123.67 SQL Injection via PostgresTrigger Node
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL...
EUVD-2026-56024
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...
EUVD-2026-56016
An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...
CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
RHSA-2026:52929 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...
Mira Hormone Monitor, Mira Android App
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user accounts. 2...
CVE-2026-44764: Missing Authorization
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...
CVE-2026-66771: Improper Neutralization of Input During Web Page Generation
SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the...
EUVD-2026-55818
A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...
CVE-2026-18948
A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...
CVE-2026-18948 Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...
EUVD-2026-55815
A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...
CVE-2026-18941
A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...
CVE-2026-18941
A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...
PYSEC-2026-3715
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret...
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
CVE-2026-21076
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21084
CVE-2026-21084 affects Samsung SmartThings prior to version 1.8.47.24, with improper access control that allows local attackers to access sensitive information. The description and connected records confirm a local attack vector with low privileges required and no user interaction, resulting in c...