85083 matches found
DRUPAL-CONTRIB-2026-140
This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...
CVE-2026-80117
creationtimestamp| type| source ---|---|--- 2026-09-09 15:00:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv3shkbndg2c 2026-09-09 15:00:03+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117241675871290048...
CVE-2026-86745
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...
CVE-2026-86742
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...
CVE-2026-61909
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...
UBUNTU-CVE-2026-61909
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...
CVE-2026-79952
creationtimestamp| type| source ---|---|--- 2026-09-09 13:52:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2egygzu3hjnnw...
EUVD-2026-74922
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...
CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...
CVE-2026-86745
Snipe-IT (IT asset management) master-branch builds after 8.6.3 are vulnerable to CSV Formula Injection in the Location-Scoping Export. The SettingsController::downloadLocationScopingReport endpoint (GET /admin/settings/location-scoping-report.csv) streams data through a bare fputcsv() call witho...
CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...
CVE-2026-86743
Snipe-IT versions before 8.7.0 contain an authorization bypass in the asset acceptance report functionality. The root cause is a failure to properly scope asset acceptance report queries by company, allowing authenticated users with the reports.view permission to read pending acceptances across a...
CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...
CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...
CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...
CVE-2026-86742
Snipe-IT versions through 8.6.3 are vulnerable to CSV formula injection via the unaccepted assets acceptance report export. The ReportsController::postAssetAcceptanceReport method builds the CSV by hand without applying League\Csv\EscapeFormula or honoring the app.escape_formulas config, unlike s...
EUVD-2026-74919
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...
CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...
CVE-2026-76202
creationtimestamp| type| source ---|---|--- 2026-09-09 11:49:09+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv3hs62yqe2t 2026-09-13 16:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvfzqtnhay2j...