CVE-2026-72555

Peppermint Lab Peppermint is affected by a broken access control vulnerability (CVE-2026-72555) caused by the Config.roles_active flag defaulting to false, making all permission checks on ticket, client, and user handlers no-ops on default installations. As a result, all authenticated users can r...

CVE-2026-72546 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-19518

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

DEBIAN-CVE-2026-19518

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

UBUNTU-CVE-2026-19518

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

CVE-2026-19518

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

CVE-2026-19518

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

CVE-2026-19518

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

CVE-2026-19518

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

CVE-2026-19518

Technical details about CVE-2026-19518 are not publicly available in the provided documents. Monitor for updates from NVD, CVE List, and EUVD sources.

CVE-2026-44764

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...

EUVD-2026-55865

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve,...

CVE-2026-44764 Missing Authorization Check in SAP Manufacturing Integration and Intelligence

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...

PT-2026-70076

Name of the Vulnerable Software and Affected Versions Samsung Open Source rlottie affected versions not specified Description Improper validation of the specified quantity in input allows for input data manipulation. Recommendations At the moment, there is no information about a newer version tha...

PT-2026-70238

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

PT-2026-70024

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A missing authorization check allows an unauthenticated attacker to access backend operations by sending crafted requests to the 'Cost Servlet' endpoint...

CVE-2026-19518: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation...

CVE-2025-13294

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

CVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

CVE-2026-71576 Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...