https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T21:03:53.234549+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-74068 cnvd-2020-74068 2026-10-08T21:03:53.299962+00:00 cnvd-2020-74068 https://cve.radiocsirt.org/vuln/euvd-2026-45945 EUVD-2026-45945 2026-10-08T21:03:53.300003+00:00 EUVD-2026-45945 https://cve.radiocsirt.org/vuln/fkie_cve-2020-26176 fkie_cve-2020-26176 2026-10-08T21:03:53.300017+00:00

An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to gather valid attachment IDs for workitems that do not belong to them.

 https://cve.radiocsirt.org/vuln/ghsa-w664-p7q3-cm25 GHSA-w664-p7q3-cm25 2026-10-08T21:03:53.300050+00:00

An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to gather valid attachment IDs for workitems that do not belong to them.

 https://cve.radiocsirt.org/vuln/gsd-2020-26176 gsd-2020-26176 2026-10-08T21:03:53.300068+00:00 gsd-2020-26176