androguard

Androguard Androguard: Reverse engineering and pentesting for Android applications Androguard 5 is a Python toolkit for Android reverse engineering: open an APK, inspect the manifest and DEX, disassemble or decompile code, hunt references and vulnerabilities, and optionally patch or analyze nativ...

EUVD-2026-98064

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

EUVD-2026-98005

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109673

Frappe ERPNext versions prior to 15.103.0 and 16.x before 16.12.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the improper neutralization of certain record names when rendered on specific dashboards, tools, and portals. Authenticated attackers can craft malicious...

CVE-2026-109668

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are affected by a missing authorization vulnerability in specific endpoints handling party records . This flaw allows authenticated users with low-privileged accounts to perform unauthorized data modifications beyond their assigned r...

CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

CVE-2026-109637

Frappe ERPNext versions before 16.14.0 are susceptible to a missing authorization vulnerability (CWE-862). This flaw allows authenticated users to bypass role-based restrictions and perform unauthorized modifications to master data records. The issue stems from specific endpoints lacking proper a...

CVE-2026-109622

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are affected by a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce proper authorization checks, allowing authenticated users to send requests that modify data beyond their permitted roles. This flaw di...

CVE-2026-109616

The Frappe ERPNext application is vulnerable to a missing authorization flaw in versions prior to 15.121.3 and 16.x before 16.35.0 . The root cause is that certain endpoints fail to enforce proper authorization checks, allowing authenticated users to send requests that modify data beyond the perm...

CVE-2026-109616 Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109611

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper authorization checks, allowing authenticated users to call these endpoints and modify data beyond the scope of their assigned roles. E...

CVE-2024-57373

CSRF Vulnerability in LifestyleStore v1.0 📌 Overview This repository documents a Cross-Site Request Forgery CSRF vulnerability identified in the LifestyleStore v1.0 project. The flaw allows attackers to perform unauthorized actions on behalf of authenticated users, posing risks to data integrity...

CVE-2026-87744 Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

EUVD-2026-97766

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-87744

A security flaw in Quarkus REST Data Panache allows unauthenticated attackers to bypass security controls on generated endpoints. The vulnerability occurs when a developer customizes an operation using @MethodProperties without explicitly re-declaring security roles; the code generator silently d...

CVE-2026-87744

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2025-25614

CVE-2025-25614 Incorrect Access Control in Unifiedtransform v2.0 leads to Privilege Escalation, allowing teachers to update the personal data of fellow teachers. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to the following endpoint: /teachers/edit/3...

CVE-2026-85969

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to an out-of-bounds write vulnerability within certain language-processing functionality . A remote authenticated attacker can exploit this flaw to cause server instability or achieve limited modification ...

EUVD-2026-97564

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of...

dovecot: Dovecot: MySQL multi-byte escaping wrong

A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges...