https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 13:20:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-45260 <p><strong>Affected:</strong> pimcore</p> <p>Pimcore is an Open Source Data &amp; Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore&#39;s WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.</p> <p><strong>Affected:</strong> pimcore</p> <p>Pimcore is an Open Source Data &amp; Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore&#39;s WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.</p> https://cve.radiocsirt.org/vuln/cve-2026-45260