https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:13:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352170 EUVD-2026-352170 https://cve.radiocsirt.org/vuln/euvd-2026-352170 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18744 <p>Any authenticated case participant can fetch any OTHER vendor&#39;s CaseStatement + per-vul CaseMemberStatus by supplying that member&#39;s id — test_func only checks _is_my_case, not ownership of kwargs[&#39;member&#39;]. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.</p> <p>Any authenticated case participant can fetch any OTHER vendor&#39;s CaseStatement + per-vul CaseMemberStatus by supplying that member&#39;s id — test_func only checks _is_my_case, not ownership of kwargs[&#39;member&#39;]. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18744 https://cve.radiocsirt.org/vuln/ghsa-8pgg-45wg-rcx3 <p>Any authenticated case participant can fetch any OTHER vendor&#39;s CaseStatement + per-vul CaseMemberStatus by supplying that member&#39;s id — test_func only checks _is_my_case, not ownership of kwargs[&#39;member&#39;]. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.</p> <p>Any authenticated case participant can fetch any OTHER vendor&#39;s CaseStatement + per-vul CaseMemberStatus by supplying that member&#39;s id — test_func only checks _is_my_case, not ownership of kwargs[&#39;member&#39;]. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.</p> https://cve.radiocsirt.org/vuln/ghsa-8pgg-45wg-rcx3