https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T14:47:55.112391+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-319687 EUVD-2026-319687 2026-10-05T14:47:55.168055+00:00 EUVD-2026-319687 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34754 fkie_cve-2026-34754 2026-10-05T14:47:55.168106+00:00

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.

 https://cve.radiocsirt.org/vuln/ghsa-h4x5-gvx6-3rwc GHSA-h4x5-gvx6-3rwc — MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API 2026-10-05T14:47:55.168142+00:00

Affected: Packagist: mantisbt/mantisbt

### Impact MantisBT allows an authenticated user to upload attachments to private Issues they are not authorized to access.

### Patches - b262b4d2835b81394d75356dead66e52a6275206

### Workarounds None.

### Credits Thanks to Vishal Shukla for discovering and responsibly reporting the issue.