781 matches found
CVE-2026-114125
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...
CVE-2026-46708
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the targ...
EUVD-2026-102098
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the targ...
CVE-2026-46708 EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the targ...
CVE-2026-46708
The open-source customer relationship management application EspoCRM (prior to version 9.3.7) is vulnerable to an authorization bypass (CWE-639, CWE-862). A low-privileged user with access to a shared TargetList can perform unauthorized opt-out or cancel-opt-out actions on protected Contact or Le...
CVE-2026-60010 Gitea organization team policy bypass through repository API
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changin...
CVE-2026-60010
Gitea versions
CVE-2026-110459
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...
CVE-2026-110459
The UniFi Protect AI Key is affected by an Improper Access Control vulnerability (CWE-284). A malicious actor with network access can exploit this flaw to obtain sensitive information, perform unauthorized changes, or execute a Denial of Service (DoS) attack on the device. No specific remediation...
EUVD-2026-100838
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...
PT-2026-113647
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...
FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-60010): Gitea -- multiple vulnerabilities
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changin...
CVE-2026-109668
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoint...
CVE-2026-104964
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...
PT-2026-102613
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...
CVE-2026-84653
A flaw was found in Jenkins. An attacker with Overall/Manage permission can exploit incorrect permission checks in the Appearance configuration page. This allows them to modify configuration options they should not have access to, potentially leading to unauthorized changes within the Jenkins...
PT-2026-96131
Name of the Vulnerable Software and Affected Versions GoCD versions 18.3.0 through 26.0.0 Description Stored cross-site scripting occurs when the server generates unescaped tracking-tool links from commit comments. This happens when a project uses a lenient Tracking Tool regular expression with a...
CVE-2026-52823
Kimai , an open-source time tracking application, contains an authenticated CSRF vulnerability in its TimesheetController (src/API/TimesheetController.php). Prior to version 2.58.0 , the stop and restart operations were exposed as GET requests without a request-forgery defense, while reusing the ...
