CVE-2026-65319 Feedbin Unauthenticated Entry Content Disclosure via GET /api/v2/entries/:id/text

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...

CVE-2026-57949

ruoyi-vue-pro (through 2026.05) contains a missing authorization vulnerability in the CRM module’s GET /admin-api/crm/follow-up-record/get endpoint. The issue allows an authenticated user to read any follow-up record by iterating sequential numeric IDs, exfiltrating follow-up notes, file attachme...

PT-2026-81915

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.56.0 Description An issue exists where team-membership checks are not enforced in the voteOnAttribute function of TimesheetVoter. This function maps permissions only to own timesheet or other timesheet. Consequently,...

CVE-2026-22602: Exposure of Sensitive Information to an Unauthorized Actor

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably e.g., 1 to 1000, an attacker can extract a complete list of all users’ fu...

EUVD-2024-19713

Malicious code in bioql PyPI...

SUSE CVE-2024-22117

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding...

CVE-2024-22117

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding...

CVE-2024-22117

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding...

CVE-2024-22117 Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding...

CVE-2024-22117

CVE-2024-22117 describes a bug in the map element URL handling where the system increments sysmapelementurlid and a manual change (sysmapelementurlid + 1) can prevent others from adding URLs. Public advisories (NVD entry and OSV listings) reference the same issue, with vendor advisories noting th...

PYSEC-2019-154

The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294...

Design/Logic Flaw

The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...

CVE-2006-0114

The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...