https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:32:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330047 EUVD-2026-330047 https://cve.radiocsirt.org/vuln/euvd-2026-330047 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54105 <p>The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the &#39;update-profile/&#39; API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary &#39;user_id&#39; parameter and receive a JSON response containing account-specific information, including the associated email address.</p> <p>The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the &#39;update-profile/&#39; API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary &#39;user_id&#39; parameter and receive a JSON response containing account-specific information, including the associated email address.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54105 https://cve.radiocsirt.org/vuln/ghsa-79rr-2p25-73c5 <p>The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the &#39;update-profile/&#39; API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary &#39;user_id&#39; parameter and receive a JSON response containing account-specific information, including the associated email address.</p> <p>The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the &#39;update-profile/&#39; API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary &#39;user_id&#39; parameter and receive a JSON response containing account-specific information, including the associated email address.</p> https://cve.radiocsirt.org/vuln/ghsa-79rr-2p25-73c5 https://cve.radiocsirt.org/vuln/va-26-169-01 <p>The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the &#39;/update-profile/N&#39; API endpoint. A remote, unauthenticated attacker could change an arbitrary user&#39;s password. The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the &#39;epds_role_id&#39; parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges. The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the &#39;update-profile/&#39; API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary &#39;user_id&#39; parameter and receive a JSON response containing account-specific information, including the associated email address. The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.</p> <p>The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the &#39;/update-profile/N&#39; API endpoint. A remote, unauthenticated attacker could change an arbitrary user&#39;s password. The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the &#39;epds_role_id&#39; parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges. The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the &#39;update-profile/&#39; API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary &#39;user_id&#39; parameter and receive a JSON response containing account-specific information, including the associated email address. The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.</p> https://cve.radiocsirt.org/vuln/va-26-169-01