CVE-2026-92772

Leantime before 3.9.6 contains an authorization bypass in the HTMX plugin install endpoint , which lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties—including identifier , version , and license key —to deploy malic...

PT-2026-37143

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9 Description The member assignment DataTables endpoint 'members assignment data.php' includes hidden profile fields in its SQL search condition regardless of visibility settings. While the JSON output suppresses...