https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:05:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-341523 EUVD-2026-341523 https://cve.radiocsirt.org/vuln/euvd-2026-341523 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65917 <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-65917 https://cve.radiocsirt.org/vuln/ghsa-947p-2q4v-5rgj <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> https://cve.radiocsirt.org/vuln/ghsa-947p-2q4v-5rgj https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2509 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um Sicherhetsmaßnahmen zu umgehen und Dateien zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um Sicherhetsmaßnahmen zu umgehen und Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2509