24147 matches found
MINI-54P3-GRM6-MVPC
Bulletin has no description...
CVE-2026-56784 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...
CVE-2026-56784
OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...
EUVD-2026-38444
OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong ...
CVE-2026-56784 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...
CVE-2026-56784
OpenRemote Manager before 1.24.2 contains an insecure direct object reference in removeAlarms(), enabling authenticated users to delete alarms across tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint does not validate that IDs belong to the caller’s realm, enabling cross-tenant...
MINI-954P-M2PG-M79J
Bulletin has no description...
MINI-Q5X2-2RWH-5V9C
Bulletin has no description...
MINI-PHVC-3MJF-C77R
Bulletin has no description...
CVE-2026-11833
creationtimestamp| type| source ---|---|--- 2026-06-23 03:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mowfv5w3xq2w 2026-06-23 03:00:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116797186334941765 2026-06-23 03:15:09+00:00| seen|...
python3.9 security update
3.9.25-7.0.1 - Remove upstream URL reference 3.9.25-7 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 3.9.25-6 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 3.9.25-5 - Rebuilding previous fixes for different build target Related: RHEL-143117,...
MINI-PQQ2-86H6-W38J
Bulletin has no description...
CVE-2026-49461
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12....
DEBIAN-CVE-2026-49461
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12....
Paymenter has broken object level authorization via service reference manipulation on ticket creation
Summary The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. Technical Details The ticket...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the ticket creation process. An attacker can gain unauthorized access to reference services belonging to other users by manipulating the service ID parameter in the request. Remediation Upgrade paymenter/payment...
MINI-33MG-RPJC-RRW8
Bulletin has no description...
MINI-M2F9-H88F-75R9
Bulletin has no description...