https://vulnerability.circl.lu Latest vulnerabilities published by the CNAs operating under the INCIBE root of the CVE Program. http://www.rssboard.org/rss-specification python-feedgen en Tue, 25 Aug 2026 15:39:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-12600 Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoderUncontrolled memory usage in Innodata Labs’ Poppler JPX decoder Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoderUncontrolled memory usage in Innodata Labs’ Poppler JPX decoder https://vulnerability.circl.lu/vuln/cve-2026-12600 Tue, 25 Aug 2026 10:57:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification https://vulnerability.circl.lu/vuln/cve-2026-78365 Mon, 24 Aug 2026 12:49:36 +0000 https://vulnerability.circl.lu/vuln/cve-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG https://vulnerability.circl.lu/vuln/cve-2026-78337 Mon, 24 Aug 2026 11:01:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers https://vulnerability.circl.lu/vuln/cve-2026-77780 Fri, 21 Aug 2026 12:12:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records https://vulnerability.circl.lu/vuln/cve-2026-77759 Fri, 21 Aug 2026 11:29:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-76203 CSS sanitizer bypass in Pentestify report themes allows forced outbound requests CSS sanitizer bypass in Pentestify report themes allows forced outbound requests https://vulnerability.circl.lu/vuln/cve-2026-76203 Wed, 19 Aug 2026 14:23:17 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75872 HTML Injection in MailerUp double opt-in verification email HTML Injection in MailerUp double opt-in verification email https://vulnerability.circl.lu/vuln/cve-2026-75872 Tue, 18 Aug 2026 14:06:37 +0000 https://vulnerability.circl.lu/vuln/cve-2026-19871 Use of hard-coded credentials in Prospero Flow CRM employee onboarding Use of hard-coded credentials in Prospero Flow CRM employee onboarding https://vulnerability.circl.lu/vuln/cve-2026-19871 Fri, 14 Aug 2026 14:00:55 +0000 https://vulnerability.circl.lu/vuln/cve-2026-19870 IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation https://vulnerability.circl.lu/vuln/cve-2026-19870 Fri, 14 Aug 2026 12:08:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes https://vulnerability.circl.lu/vuln/cve-2026-19744 Thu, 13 Aug 2026 15:41:00 +0000