CVE-2026-28685

Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/id" only checks the role-based viewinvoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLETEAMLEAD which grants viewinvoice can read a...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the cgetAction function in InvoiceController.php, which lacks proper customer-level access control. An attacker can access sensitive invoice data belonging to other teams by sending authenticated API requests...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : git, git-lfs, obs-scm-bridge, python-PyYAML (SUSE-SU-2025:03012-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03012-1 advisory. git was updated from version 2.43.0 to 2.51.0 bsc1243197: - Security issues fixed: CVE-2025-276...

DEBIAN-CVE-2017-16026

Request is an http client. If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body. This affects Request =2.2.6 2.51.0 =2.67.0...