CVE-2026-55681: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit idproduto to web/html/matPat/restaurarprodutodesocultar.php, where a second extract$REQUEST overwrites the value previously sanitized by intval. The...

CVE-2026-109666 Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assign...

CVE-2026-109666

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are affected by a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce proper permission checks on inventory records, allowing authenticated users to modify inventory data beyond their assigned role permis...

CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

EUVD-2026-42994

Snipe-IT has an authorization bypass on print inventory page...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

MAL-2026-12509 Malicious code in @shiftmarkets/shift-exchange-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9a3ac8f48d96507de8b8495dfc844f6fb44ae7667ee571dab05fc7d8453551 On npm install, the package's postinstall hook scripts.postinstall: 'node dist/recon.js || true' automatically runs dist/recon.js, which collects the...

CVE-2026-2916

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

EUVD-2026-46417

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

CVE-2026-47689 FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

CVE-2026-47689

FOGProject prior to versions 1.5.10.1832 and 1.6.0-beta.2313 is vulnerable to stored XSS. The buildRow() function in fogpage.class.php inserts data into HTML templates via str_replace() without escaping. An unauthenticated attacker who knows a registered host’s MAC address can POST malicious inve...

Authorization Bypass

Snipe-IT is vulnerable to Authorization Bypass. The vulnerability is due to inadequate authorization checks, where UsersController::show and printInventory authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, and an authenticated user...

CVE-2026-55462

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show and printInventory authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and...

CVE-2026-55462 Snipe-IT: Authorization bypass on print inventory page

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show and printInventory authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and...

CVE-2026-55462

Snipe-IT (IT asset/license management) is affected in versions prior to 8.6.2. The vulnerability in UsersController::show() and printInventory() allows an authenticated user with only the users.view permission to access inventory and cost/order metadata from modules that would normally be restric...

PT-2026-57285

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2 Description An issue exists where the UsersController::show and printInventory functions only authorize the viewing of a user before loading and rendering relationships for assigned licenses, accessories, and...

CVE-2026-56401

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-56401

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

GHSA-GVHC-WV3V-7PF8 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Summary Authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOverview only checks lenuser.Roles 0, so it returns...