8524 matches found
@cluesurf/task (0.5.4), @tadashi/doc2pdf (>=1.1.0, <=1.1.3) potentially affected by CVE-2026-54732 via libreoffice-convert (>=1.6.1, <=1.8.1)
libreoffice-convert NPM version =1.6.1, =1.1.0, =1.1.3 Source cves: CVE-2026-54732 Source advisory: GHSA-GMXC-R82Q-347R...
@cluesurf/task (0.5.4), @tadashi/doc2pdf (>=1.1.0, <=1.1.3) potentially affected by CVE-2026-54732 via libreoffice-convert (>=1.6.1, <=1.8.1)
libreoffice-convert NPM version =1.6.1, =1.1.0, =1.1.3 Source cves: CVE-2026-54732 Source advisory: OSV:GHSA-GMXC-R82Q-347R...
@cluesurf/task (0.5.4), @tadashi/doc2pdf (>=1.1.0, <=1.1.3) potentially affected by CVE-2026-54732 via libreoffice-convert (>=1.6.1, <=1.8.1)
libreoffice-convert NPM version =1.6.1, =1.1.0, =1.1.3 Source cves: CVE-2026-54732 Source advisory: MEND:CVE-2026-54732...
CVE-2026-81817
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81819
Flowintel versions >=3.3.0 expose the /my_assignment/user API endpoint with only general API authentication, lacking a role-specific restriction. The endpoint accepts a user_id parameter to return that user's task assignments, but previously allowed any authenticated user to query it. As a res...
CVE-2026-81819 Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-81819 Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-81817
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
EUVD-2026-67123
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81817
Flowintel versions ≥3.3.0 are affected by an insecure direct object reference (broken object-level authorization) across numerous task endpoints. The routes accepted both a case ID and a task ID but did not verify that the task belonged to the supplied case, allowing an authenticated user with ed...
CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
SUSE CVE-2026-68460
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in f2fsbalancefs When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below: INFO: task A:1890 blocked for more than 120 seconds. Tainted: G O 6.12.41-g3fe07ddf05ab 1...
PT-2026-82624
Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and earlier Description An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case...
PT-2026-82842
A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...
CVE-2026-80348
TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...
CVE-2026-74929
The Project Manager WordPress plugin, in versions before 4.0.7 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to restrict several REST API routes to the specific projects a user is authorized to access. This oversight allows any authenticated user, suc...
CVE-2026-74929 WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...
EUVD-2026-66279
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...
CVE-2026-74929 WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...