CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, k8ssandra-client, go-licenses, cert-exporter, mattermost, manifest-tool, bazelisk, whereabouts, opentelemetry-collector-contrib, neuvector-dbgen, nri-prometheus, traefik, terraform-provider-azurerm, vt-cli, redis-operator, grafana-mimir,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, k8ssandra-client, go-licenses, cert-exporter, mattermost, manifest-tool, bazelisk, whereabouts, opentelemetry-collector-contrib, neuvector-dbgen, nri-prometheus, traefik, terraform-provider-azurerm, vt-cli, redis-operator, grafana-mimir,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, k8ssandra-client, go-licenses, cert-exporter, mattermost, manifest-tool, bazelisk, whereabouts, opentelemetry-collector-contrib, neuvector-dbgen, nri-prometheus, traefik, terraform-provider-azurerm, vt-cli, redis-operator, grafana-mimir,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, k8ssandra-client, go-licenses, cert-exporter, mattermost, manifest-tool, bazelisk, whereabouts, opentelemetry-collector-contrib, neuvector-dbgen, nri-prometheus, traefik, terraform-provider-azurerm, vt-cli, redis-operator, grafana-mimir,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: pulumi, dagger, chezmoi, kubevela, gitea, gptscript, argo-events, k8sgpt, go-licenses, grafana-alloy, argocd-image-updater, pulumi-language-java, goreleaser, wolfictl, bom, argo-workflows, snyk-cli, pulumi-kubernetes-operator, task, kaniko, zarf, flux, kubescape, kot...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: pulumi, dagger, chezmoi, kubevela, gitea, gptscript, argo-events, k8sgpt, go-licenses, grafana-alloy, argocd-image-updater, pulumi-language-java, goreleaser, wolfictl, bom, argo-workflows, snyk-cli, pulumi-kubernetes-operator, task, kaniko, zarf, flux, kubescape, kot...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: telegraf, boring-registry, grafana-rollout-operator, cri-tools, terraform-docs, frp, ratify, stakater-reloader, bento, crossplane-provider-aws-cloudformation, ferretdb, volume-modifier-for-k8s, container-object-storage-interface, http-echo, gptscript, minio-operator,...

CVE-2026-12690 ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...

CVE-2026-55479

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin...

CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...

EUVD-2026-42986

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...

CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...

CVE-2026-55478

Snipe-IT (IT asset/license management) has a vulnerability in the Kits API. Before version 8.6.2, POST /api/v1/kits/{kit_id}/licenses validates the caller’s ability to edit kits but does not authorize access to the referenced license object. This allows a low-privilege user with predefined-kit pe...

CVE-2026-7686

A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.js of the component Legacy Premium Activation. Performing a manipulation results in improper access controls. Remote exploitation of the...

CVE-2026-32100 swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes

Shopware is an open commerce platform. /api/info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...

CVE-2026-22645

The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components...

CVE-2026-22645

The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components...

CVE-2025-41086

Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculat...

CVE-2025-41086

Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculat...

CVE-2025-41086

Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculat...