https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 05:36:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336954 EUVD-2026-336954 https://cve.radiocsirt.org/vuln/euvd-2026-336954 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57949 <p>ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module&#39;s GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users&#39; follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.</p> <p>ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module&#39;s GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users&#39; follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-57949 https://cve.radiocsirt.org/vuln/ghsa-pv3j-frmx-3v9q <p>ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module&#39;s GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users&#39; follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.</p> <p>ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module&#39;s GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users&#39; follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.</p> https://cve.radiocsirt.org/vuln/ghsa-pv3j-frmx-3v9q