CVE-2026-75505
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission c
CVSS
—
No CVSS
EPSS
0.3%
p21
KEV
—
Exploit Today
6
0-100
Published: Oct 15, 2026 · Last modified: Oct 16, 2026 · CWE-862
0.3%EPSS · 30 days0.3%
2026-10-162026-10-20
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-70386——
——0Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared
and no user interaction beyond launching it, can execute arbitrary shell
commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects
combine: (a) OnePlus's atlasservice binder interface accepts
setEvent(String8 name, String8 value) from any caller without
authorization, and (b) one event handler
(OplusAtlasLogWriter::handleEvent, matching event name
atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value
into the system property oplus.audio.dumpinfo.type and starts the root
init service audiodumpinfo, which passes that property value unsanitized
to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.12hCVE-2026-1140828.1 HIG—
——0Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.20hCVE-2026-1140713.1 LOW—
——0Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.20hCVE-2026-1140584.3 MED—
——0ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.20hCVE-2026-1140574.3 MED—
——0ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.20hCVE-2026-1140564.3 MED—
——0ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.20h