CVE-2026-116020

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...

PT-2026-122601

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...

Guchengwuyue YSHOP Image CRM Authorization Issues and Vulnerabilities

GuChengWuyue YSHOP Image CRM 2.1.3 and earlier versions have an authorization issue vulnerability. This vulnerability stems from insecure direct object references. Certified sales users can access other users’ customer records by providing arbitrary IDs. It is possible to enumerate IDs, read...

CVE-2026-45295

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint "GET /thread/read/conversationid/threadid" allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state "openedat"...

CVE-2026-44884 Portainer: Missing authorization on custom template file endpoint exposes template content

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint GET...