CERT/CC vulnerabilities
Published CVEs affecting CERT/CC products: 6 record(s), with severity, exploitation and fixes.
CVE-2026-18750
Medium · 5.3
CWE-639 Aug 12, 2026
CVE-2026-18750
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.
CVE-2026-18749
Critical · 9.8
CWE-639 Aug 12, 2026
CVE-2026-18749
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.
CVE-2026-18744
Medium · 6.5
CWE-639 Aug 12, 2026
CVE-2026-18744
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.
CVE-2026-8142
Medium · 6.5
May 7, 2026
CVE-2026-8142
VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.
CVE-2026-35467
High · 7.5
CWE-522 Apr 2, 2026
Private Key stored as extractable in browser IndexeDB
The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
CVE-2026-35466
Medium · 6.1
CWE-79 Apr 2, 2026
Stored XSS via unsanitized input from remote service
XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services