MINI-JCWW-8MR3-QMJ4

Bulletin has no description...

MINI-84HQ-MFVC-3Q8M

Bulletin has no description...

MINI-FWWJ-6PXJ-VQMF

Bulletin has no description...

MINI-9PMC-JQ9G-3CQJ

Bulletin has no description...

MINI-MX62-MR68-8VW3

Bulletin has no description...

MINI-J23R-G3GJ-2G34

Bulletin has no description...

MINI-P682-M2GF-WJVG

Bulletin has no description...

MINI-6569-QXRR-8JRV

Bulletin has no description...

MINI-WM7F-QWJV-PV3W

Bulletin has no description...

MINI-4RJ4-GJJX-6WC2

Bulletin has no description...

MINI-X82H-GFV9-586W

Bulletin has no description...

MINI-RG96-WP44-JGPP

Bulletin has no description...

MINI-3M3Q-7X2V-7W67

Bulletin has no description...

MINI-X34C-FGV9-H4CV

Bulletin has no description...

MINI-44CG-M7RG-JHQ5

Bulletin has no description...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the getDynamicIcon process. An attacker can retrieve sensitive database content by sending crafted requests to the unauthenticated endpoint with a valid block ID and specially crafted...

CVE-2026-61460

Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CR...

EUVD-2026-42993

The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...

EUVD-2026-42985

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse...

EUVD-2026-42960

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloccentralHeader.size allocates memory based on the declared uncompressed size from the ZIP central directory header without...