https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T08:06:27.329977+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-374840 EUVD-2026-374840 2026-10-16T08:06:27.332158+00:00 EUVD-2026-374840 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59708 fkie_cve-2026-59708 2026-10-16T08:06:27.332188+00:00

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.

 https://cve.radiocsirt.org/vuln/ghsa-fqj2-r74g-4gfp GHSA-fqj2-r74g-4gfp 2026-10-16T08:06:27.332218+00:00

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.