CVE-2026-86767

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

CVE-2026-86767 Snipe-IT before 8.7.0 Cross-Company Read via requested-assets

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

CVE-2026-86767 Snipe-IT before 8.7.0 Cross-Company Read via requested-assets

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

CVE-2026-86767

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled. Authenticated users holding the assets.view permission can retrieve pending asset requests from all companies without parameter manipulation,...

CVE-2026-86747

Snipe-IT is an open-source IT asset management system. In versions up to and including 8.6.3 , when Full Multiple Company Support (FMCS) is enabled, the authorization guard in ReportsController::currentUserCanAccessAcceptance() early-returns true for pivot-only users (whose users.company_id colum...

CVE-2026-86747 snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

CVE-2026-19946

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

CVE-2026-19946

The Awesome Support plugin for WordPress (versions up to and including 6.3.9 ) contains a Missing Authorization flaw in the wpas_do_mr_deny_user() function. Unlike its counterpart wpas_do_mr_activate_user(), this function fails to enforce a current_user_can('edit_users') capability check, relying...

CVE-2026-19946 Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

EUVD-2026-74686

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.2.31 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

CVE-2026-19946: Missing Authorization

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

PT-2026-89036

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

CVE-2026-83593: Improper Neutralization of Input During Web Page Generation

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible f...

PT-2026-88848

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas do mr deny user function, which unlike its counterpart wpas do mr activate user does not enforce current user can'edit...

PT-2026-89016

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unaccepted assets/sent reminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unaccepted assets/acceptanceId/delete...

thunderbird security update

140.14.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 140.14.0 - Add OpenELA debranding 140.14.0-1 - Update to 140.14.0 ESR...

PT-2026-88865

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket...

CVE-2026-86767: Exposure of Sensitive Information to an Unauthorized Actor

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...