https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T00:25:03.696341+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-369823 EUVD-2026-369823 2026-10-08T00:25:03.698642+00:00 EUVD-2026-369823 https://cve.radiocsirt.org/vuln/fkie_cve-2026-92459 fkie_cve-2026-92459 2026-10-08T00:25:03.698673+00:00

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.

 https://cve.radiocsirt.org/vuln/ghsa-qwxr-xhwf-5r52 GHSA-qwxr-xhwf-5r52 2026-10-08T00:25:03.698703+00:00

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.