527 matches found
EUVD-2026-42986
Snipe-IT has missing object-level authorization in Kits API...
Chinese-Cybercrime-Research
Ricerca sulla criminalitΓ informatica cinese Risorse per approfondire gli attori della criminalitΓ informatica in lingua cinese. Phishing Kit di phishing YYlaiyu https://cloud.google.com/blog/topics/threat-intelligence/chinese-language-phishing-services...
EUVD-2026-65160
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
CVE-2026-27364
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
CVE-2026-27364
Broken Access Control vulnerability in the WordPress Style Kits plugin (AnalogWP) versions β€ 2.6.5 . A Subscriber -level authenticated user can exploit insufficient access controls, resulting in a high impact on integrity (CVSS 3.1: 6.5 MEDIUM, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No conf...
CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
PT-2026-81045
Name of the Vulnerable Software and Affected Versions Style Kits versions prior to 2.6.6 Description Broken Access Control allows a user with Subscriber privileges to perform unauthorized actions. Recommendations Update Style Kits to version 2.6.6 or later...
CVE-2026-65484
Technical details for CVE-2026-65484 are not publicly available in the provided documents; monitor for updates.
EUVD-2026-48095
Contributor Broken Access Control in Style Kits = 2.6.5 versions...
Improper Authorization
Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks when adding licenses to predefined kits, where the API validates kit edit permissions but not access to the referenced license, allowing low-privilege users to associate licenses they are no...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478
Snipe-IT (IT asset/license management) has a vulnerability in the Kits API. Before version 8.6.2, POST /api/v1/kits/{kit_id}/licenses validates the callerβs ability to edit kits but does not authorize access to the referenced license object. This allows a low-privilege user with predefined-kit pe...
PT-2026-57269
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2 Description An authorization flaw exists in the IT asset and license management system. The endpoint "/api/v1/kits/kit id/licenses" verifies if the user has permissions to edit kits but fails to authorize acces...
CVE-2026-55878
Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative accepts paths like ../../../etc, a crafted or...
CVE-2026-49336
@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, @microsoft/kiota-http-fetchlibrary's RedirectHandler is documented as stripping Authorization and Cookie from cross-origin redirect targets, bu...
β‘ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
Stuff broke again. Not in a movie way. An old tool was left exposed. An abandoned package was abused. A deprecated feature was still running in prod. This week is the same lesson in a new form: phishing kits are easier to rent, AI names are useful bait, old login paths still fail, and forgotten...
INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator
An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service PhaaS platform, Group-IB said Thursday. The effort, codenamed Operation Ramz, took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle...
CVE-2026-6565
The Style Kits β Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/wp-json/agwp/v1/tokens/save' endpoint kit title parameter in versions up to, and including, 2.5.0 due to insufficient input...