CVE-2026-16544 Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

Mini-Inventory-and-Sales-Management-System Cross-Site Request Forgery Vulnerability

Mini-Inventory-and-Sales-Management-System is an inventory and sales management system written in PHP codeIgniter with support for MySQL and Sqlite3 databases. A cross-site request forgery vulnerability exists in Mini-Inventory-and-Sales-Management-System version 1.0, which stems from...