EUVD-2026-87212

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

CVE-2026-56726

The Zammad open source helpdesk system contains a vulnerability in versions prior to 7.0.2 where a missing authorization check in the GitHub and GitLab integrations breaks ticket isolation boundaries. Any authenticated agent, regardless of their assigned tickets, can view the titles, status, labe...

GO-2026-6041 Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea

Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...

CVE-2026-58419

Notification API leaks private issue metadata after access revocation...

CVE-2026-34970

Summary: CVE-2026-34970 affects MantisBT, where versions 2.28.1 and earlier allow a bugnote author to view the Revisions page of a private issue after losing access to that issue. This undermines confidentiality by exposing private issue metadata on the Revisions page. Root cause (as described): ...

Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode

Summary Several API endpoints in authenticated mode have no authentication at all. They respond to completely unauthenticated requests with sensitive data or allow state-changing operations. No account, no session, no API key needed. Verified against the latest version. Discord: sagi03581 Steps t...

PT-2026-24363

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.14.24 through 3.19.3 Description An improper authorization issue was found in GitHub Enterprise Server. A user with read access to a repository and write access to a project could modify issue and pull reque...

CVE-2023-40425

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14, macOS Monterey 12.7.1. An app with root privileges may be able to access private information...

EUVD-2019-4039

Malware in sbrugna...

EUVD-2021-1643

Malware in sbrugna...

EUVD-2008-4668

Malware in sbrugna...

EUVD-2021-6550

Malicious code in bioql PyPI...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

CVE-2025-7884

CVE-2025-7884 affects Eluktronics Control Center 5.23.51.41, specifically the REG File Handler. The underlying issue is insufficient verification of data authenticity, allowing a local-host attack. Public disclosure exists, and vendor response is noted as lacking. NVD reports a HIGH impact across...

CVE-2024-42912: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in META-INF Kft. Email This Issue Data Center before 9.13.0-GA allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the recipient field of an e-mail message...

CVE-2022-2146

The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting...

CVE-2019-13267

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After i...

CVE-2024-46547

A security vulnerability exists in Romain Bourdon Wampserver (all versions, discovered in v3.2.3 and v3.2.6 ) due to improper access control validation via the PHP Info Page . This flaw allows unauthorized users to access sensitive information, potentially leading to data leaks . No specific reme...