CVE-2026-72547

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72547

CVE-2026-72547 affects Attendize (Attendize project) via the postImportAttendee endpoint. The flaw is an insecure direct object reference: the system loads the target event by ID without verifying ownership against the requesting organiser account, enabling any authenticated event organiser to bu...

PT-2026-70348

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. This flaw allows a low-privileged attacker to bypass security features and...

CVE-2026-73227: Improper Limitation of a Pathname to a Restricted Directory

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in...

PT-2026-70376

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An improper input validation issue allows for a security feature bypass. An attacker can exploit this to gain unauthorized write access. This requires user interaction, such a...

PT-2026-70782

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description Improper input validation allows an attacker to bypass security features and obtain unauthorized limited write access. This issue can be exploited without any user interaction...

CVE-2026-48411: Incorrect Authorization

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require use...

PT-2026-70346

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An Improper Encoding or Escaping of Output issue allows a low-privileged attacker to bypass security features. This can lead to limited unauthorized write acces...

CVE-2026-48385: Improper Neutralization of Special Elements used in an OS Command

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

CVE-2026-34635: Use of Hard-coded Cryptographic Key

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user...

CVE-2026-25652: Incorrect Authorization

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction...

CVE-2026-21279: Improper Input Validation

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction...

CVE-2026-48376: Improper Encoding or Escaping of Output

is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability...

CVE-2026-71383: Incorrect Authorization

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this...

CVE-2026-48437: Improper Certificate Validation

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interactio...

CVE-2026-48415: Incorrect Authorization

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

PT-2026-70257

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. The callback rout...

CVE-2026-71390: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user...

CVE-2026-48436: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...

CVE-2026-72910

CVE-2026-72910 affects ERPNext prior to versions 15.112.0 and 16.22.0. The issue arises because the functions merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center (across ERPNext code paths: erpnext/accounts/doctype/account/account.py, erpnext/account...