File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Summary A scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, and the application's own database via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 ScopedFs containme...

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...

GHSA-X756-G4X3-C64M Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...

CVE-2026-56624

Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or...

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-47129

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

CVE-2026-44585

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

CVE-2026-55544 NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

CVE-2026-55544

NextCRM (open-source) vulnerability CVE-2026-55544 affects version 0.12.1, where MCP campaign tools expose read/write operations over the network via user-generated Bearer tokens (nxtc__...). Despite an authorization model restricting normal users to their own campaigns, multiple MCP handlers ign...

CVE-2026-55544 NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

CVE-2026-47129 NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

CVE-2026-47129

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

CVE-2026-47129

Summary of CVE-2026-47129 (NextCRM) : NextCRM versions prior to 0.12.0 contain a Broken Access Control flaw in the Next.js Server Actions activateUser/deactivateUser. The application does not verify that the requester has the admin role, allowing any authenticated user (even with member/viewer ro...

CVE-2026-47129 NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

CVE-2026-53591

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted In-Reply-To header. No...

CVE-2026-15788

BuildKit's cache mount source= selector on Windows Container on Windows WCOW workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon...

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...