PT-2026-51440

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.5.0 Description The email update functionality fails to invalidate the existing verification state when a user changes their email address. This allows a verified account to retain its verified status after...

PT-2026-51320

Name of the Vulnerable Software and Affected Versions Mattermost version 11.7.0 Mattermost versions prior to 10.11.17 Description Insufficient enforcement of bot-specific permission checks on the user active status endpoint allows a User Manager with user management write access, but lacking...

MINI-F3M6-Q24V-JVP6

Bulletin has no description...

CVE-2026-10877

creationtimestamp| type| source ---|---|--- 2026-06-21 17:55:41+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116789381354188381...

CVE-2026-56229

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

CVE-2026-56229

Capgo before 12.128.2 has an authorization bypass in /build/status and /build/logs that lets an attacker access build jobs from other apps by mixing app_id and job_id. Limited API keys scoped to one app can read status/logs across apps by using an authorized app_id with a job_id from another app,...

CVE-2026-56229 Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

CVE-2026-56229

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

CVE-2026-56229 Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

EUVD-2026-38164

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

CVE-2026-56229 Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

MINI-2Q3P-5HC5-XQ7G

Bulletin has no description...

CVE-2026-12782

creationtimestamp| type| source ---|---|--- 2026-06-21 10:32:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116787630904398394 2026-06-22 01:39:40+00:00| seen| https://www.acn.gov.it/portale/w/easeus-poc-pubblici-per-il-prodotto-partition-master...

PT-2026-51218

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description An authorization bypass exists in the '/build/status' and '/build/logs' endpoints. Attackers can access build jobs belonging to different applications by providing a mismatched app id and job id...

CVE-2026-56304

creationtimestamp| type| source ---|---|--- 2026-06-20 20:19:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moqok5jmtt2f...

CVE-2026-51846

creationtimestamp| type| source ---|---|--- 2026-06-20 16:10:14+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116783304621209682...

CVE-2019-25763

creationtimestamp| type| source ---|---|--- 2026-06-20 15:59:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moq7z4l7zk2b...

CVE-2026-56267 Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs,...

GHSA-4XGF-CPJX-PC3J

creationtimestamp| type| source ---|---|--- 2026-06-20 14:29:23+00:00| seen| https://gist.github.com/konard/4b48b247d88d1fe3f1e7f6cd34987449...

SUSE CVE-2026-54274

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1...