astro_CVE-2026-33532

Astro Starter Kit: Minimal npm create astro@latest -- --template minimal 🧑‍🚀 Seasoned astronaut? Delete this file. Have fun! 🚀 Project Structure Inside of your Astro project, you'll see the following folders and files: / ├── public/ ├── src/ │ └── pages/ │ └── index.astro └── package.json Astro...

CVE-2026-112293

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112293 BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112293

The BoxyHQ Enterprise SaaS Starter Kit through version 1.6.0 is vulnerable to a missing authorization vulnerability (CWE-862 ). The root cause is that specific payment routes fail to perform the team_payments permission check, allowing non-owner team members to manage billing. Authenticated users...

CVE-2026-112293 BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

EUVD-2026-104280

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112293: Missing Authorization

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-103475

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

CVE-2026-103474

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103476

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...

EUVD-2026-90207

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...

CVE-2026-103476

The yii2-starter-kit software, version through 4.2.0 , is vulnerable to an unauthorized file download due to a failure to validate article publication status in the attachment-download endpoint. This flaw allows unauthenticated attackers to bypass authorization checks and retrieve files associate...

CVE-2026-103476 yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...

CVE-2026-103476 yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...

CVE-2026-103476 yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...

CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103475 yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

EUVD-2026-90206

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...