CVE Vulnerability Catalog

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7. Authenticated users of any company can read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and hijack that product by reassigning its company_id, via the product's numeric identifier, because ProductUpdateController did not extend MainController and therefore required no authentication check on the read endpoint, and ProductRepository::save() retrieved the record via Product::find($data['id']) without constraining the query to the authenticated user's company before overwriting its company_id.

SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.

A vulnerability in OpenSSL's QUIC server implementation allows a remote attacker to cause unbounded memory allocation by sending Initial packets with unknown connection IDs. The lack of a limit on pending connections can lead to memory exhaustion and denial of service (DoS). The issue is present since OpenSSL 3.5.

ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.

Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.

Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.

Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.

Unauthenticated Broken Access Control vulnerability in GiveWP plugin versions prior to 4.16.6.

Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

Author-level Cross Site Scripting (XSS) vulnerability in WP Data Access plugin versions up to and including 5.5.79.

Contributor-level Cross Site Scripting (XSS) vulnerability in Featured Image from URL plugin versions up to and including 5.3.3.

This CVE has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610.

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service.

In basecamp/upright at a specific commit, Rails CSRF protection is disabled for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.