https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:37:13.819380+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-18750 CVE-2026-18750 — CVE-2026-18750 2026-10-07T00:37:13.839732+00:00

Affected: CERT/CC VINCE

vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.