2026

  • another sharp authz bug, this time in quick creation

    cve-2026-53634 let authenticated sharp users bypass create authorization through quick creation command endpoints

    b b4r
    June 10, 2026
    2 min read
    vulnerability cve web exploitation laravel

  • an idor in openproject through meeting agenda items

    cve-2026-49355 exposed private work package data through the single meeting agenda item api in openproject

    b b4r
    June 8, 2026
    3 min read
    vulnerability cve web exploitation idor

  • two wallos cves from the same trust mistake

    cve-2026-50198 and cve-2026-50199 in wallos both came from cross-user references being accepted first and trusted later

    b b4r
    June 5, 2026
    4 min read
    vulnerability cve web exploitation