CVE-2026-46708

The open-source customer relationship management application EspoCRM (prior to version 9.3.7) is vulnerable to an authorization bypass (CWE-639, CWE-862). A low-privileged user with access to a shared TargetList can perform unauthorized opt-out or cancel-opt-out actions on protected Contact or Le...

CVE-2020-5217

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...