12546 matches found
EUVD-2026-74935
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...
CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...
CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...
CVE-2026-86758
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...
CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...
CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...
CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...
CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...
CVE-2026-86742
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...
CVE-2026-87809
Siyuan before v3.8.2 contains an information disclosure flaw where publish-access filtering is not applied to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. An attacker with reader-level access can retrieve the full rendered content of private...
CVE-2026-87809
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing publ...
CVE-2026-87809 Siyuan before v3.8.2 Information Disclosure via Export Preview
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing publ...
CVE-2026-87809 Siyuan before v3.8.2 Information Disclosure via Export Preview
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing publ...
CVE-2026-87809 Siyuan before v3.8.2 Information Disclosure via Export Preview
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing publ...
CVE-2026-21108
Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information...
CVE-2026-21113
Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission...
CVE-2026-21113
Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission...
CVE-2026-21113
CVE-2026-21113 is an improper export of Android application components in Samsung VisualVoicemail prior to version 20.1.00.05 . The flaw allows local attackers with low privileges to initiate a call without proper permission , resulting in low impacts to confidentiality, integrity, and availabili...