524649 matches found
CVE-2026-112290
The Intelligence Community UI Kit (@ukic/canary-web-components) versions 3.0.0-canary.12 before 3.0.0-canary.48 are vulnerable to a DOM-based cross-site scripting (XSS) vulnerability in the ic-tree-item component. The root cause is that the component re-parses router-item slot text as HTML. Speci...
CVE-2026-112290 MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...
EUVD-2026-104283
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...
CVE-2026-112288
Krayin CRM versions 2.2.5 before 2.2.7 are vulnerable to a Server-Side Request Forgery (SSRF) filter bypass. The flaw resides in the WebhookService::isSafeEndpoint() validation logic, where an attacker can use DNS rebinding to bypass security checks. By returning a public address during validatio...
CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...
EUVD-2026-104285
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...
CVE-2026-112285
The Thelia e-commerce platform is affected by a business logic vulnerability in versions prior to 3.1.5 and 3.2.x before 3.2.4 . The flaw arises because coupon usage is only recorded once an order is paid. Authenticated customers can exploit this by placing multiple pay-later orders to bypass usa...
CVE-2026-112285 Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...
CVE-2026-112285 Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...
EUVD-2026-104288
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...
CVE-2026-112268 sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes
sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...
CVE-2026-112268
The sglang-router (sgl-model-gateway) version 0.3.2 and below is vulnerable to an authorization bypass due to insufficient access control on mesh HA management routes . Specifically, the */ha/ endpoints fail to perform required control-plane Admin role checks. This allows holders of a standard da...
EUVD-2026-104305
sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...
CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
CVE-2026-111939
Frappe Helpdesk versions prior to 1.26.0 are vulnerable to an authorization bypass (CWE-639). The flaw allows authenticated portal users to create tickets while impersonating other customers by providing a specific raised_by value when calling the hd_ticket.api.new endpoint. This allows an attack...
EUVD-2026-104312
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
CVE-2026-111915 Yank Note before 3.93.1 Path Traversal via /api/help Endpoint
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...
CVE-2026-111915
Versions of Yank Note prior to 3.93.1 are vulnerable to a path traversal vulnerability (CWE-22) via the /api/help endpoint. Unauthenticated remote attackers can bypass single-replacement sanitization by supplying repeated ../ segments in the path or doc parameters. This flaw allows attackers to r...
CVE-2026-111915 Yank Note before 3.93.1 Path Traversal via /api/help Endpoint
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...