MINI-CW73-V8JH-RQRP

Bulletin has no description...

MINI-6W3F-W7WJ-5W55

Bulletin has no description...

CVE-2026-81181 SysReptor: Session Fixation in Password-Protected Shared Notes

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...

CGA-J9GW-C547-Q6VQ

Bulletin has no description...

CGA-VFG5-P259-MPFJ

Bulletin has no description...

CGA-R9R3-55FW-JG6J

Bulletin has no description...

CVE-2026-81182 SysReptor: Unauthorized file disclosure by broken access control in writable shared notes

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The...

MINI-39P4-RF2X-QJCP

Bulletin has no description...

MINI-9VVP-Q8CR-G42Q

Bulletin has no description...

MINI-M465-4P3W-V4FX

Bulletin has no description...

MINI-2W67-3G5G-73Q9

Bulletin has no description...

CVE-2026-81180 SysReptor: Authenticated RCE by insecure image processing

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

MINI-4V9W-VQ7J-7CCM

Bulletin has no description...

MINI-VMGH-4HX3-2H9R

Bulletin has no description...

MINI-QX46-QC53-PHFX

Bulletin has no description...

MINI-M832-H4QM-5FVF

Bulletin has no description...

MINI-WWJF-XQHQ-38FH

Bulletin has no description...

MINI-8CMV-P93G-QJ93

Bulletin has no description...

MINI-MX4G-2V2H-W57J

Bulletin has no description...

MINI-H3F3-F99M-PC9C

Bulletin has no description...

MINI-JR2C-8RXC-HH36

Bulletin has no description...

MINI-9HF8-FG73-8JMQ

Bulletin has no description...

MINI-3PR3-33H4-4M6J

Bulletin has no description...

MINI-X2WF-W58Q-V2QH

Bulletin has no description...

MINI-RWRC-H383-MM79

Bulletin has no description...

MINI-R934-C39J-RRGX

Bulletin has no description...

MINI-8G5H-HW9Q-C8QV

Bulletin has no description...

MINI-64R5-M5QR-3M65

Bulletin has no description...

CVE-2026-81179 SysReptor: Host header injection might allow account takeover

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

MINI-35WX-4Q84-F5R2

Bulletin has no description...

MINI-C374-M9XP-76QR

Bulletin has no description...

MINI-2R7R-RWCC-8FHR

Bulletin has no description...

MINI-CPXM-HH7X-886W

Bulletin has no description...

CVE-2026-81178 SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and...

CVE-2026-71537 Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade relies on Service::upgradable to check for a pending service upgrade and later executes $credit-increment'amount', abs$price without DB::transactio...

MINI-H4WJ-73HJ-3653

Bulletin has no description...

MINI-MQHW-J2P6-VXQG

Bulletin has no description...

MINI-PJQR-2QMW-R45M

Bulletin has no description...

MINI-7P2W-P2W4-CCQ7

Bulletin has no description...

MINI-8JVJ-5JC3-6PVR

Bulletin has no description...

MINI-W589-4WGC-CV6P

Bulletin has no description...

MINI-9XF7-8P56-7WM4

Bulletin has no description...

CVE-2026-85058 Moquette: Missing Authorization in io.moquette:moquette-broker

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict...

GHSA-VR5F-W35Q-98JP Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

GHSA-4227-9989-JRHX Perses's missing authorization in datasource proxy allows cross-scope secret disclosure

Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check. Datasource and Secret are distinct, independently grantable role scopes, so an operator can grant datasource access without secret...

GHSA-CJGJ-2FWF-4C2W Perses's project query parameter authorization bypass exposes cross-project resources

Impact What kind of vulnerability is it? An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret or simply GET /api/v1/datasources?project=finance-secret and receives the full list of the finance-secret project's dashboar...

MINI-J5PR-8WXM-GQG2

Bulletin has no description...

MINI-9MCJ-J9V3-RX66

Bulletin has no description...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63199 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...