Find a vulnerability

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T16:09:13.747209Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T17:00:09.078Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "solidtime",
          "vendor": "solidtime-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T19:31:54.604Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j"
        },
        {
          "name": "https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be"
        },
        {
          "name": "https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cj49-589g-wp6j",
        "discovery": "UNKNOWN"
      },
      "title": "Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76806",
    "datePublished": "2026-11-04T19:31:54.604Z",
    "dateReserved": "2026-08-19T19:52:28.212Z",
    "dateUpdated": "2026-11-09T17:00:09.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47236",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T13:09:45.966353Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T13:09:55.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "solidtime",
          "vendor": "solidtime-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.12.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Solidtime is an open-source time-tracking app. Prior to version 0.12.2, Solidtime defines an explicit invitations:view and members:view permissions that gates the official invitations and members API. The Jetstream web team page authorizes access with only belongsToTeam() and then loads and serializes all pending invitation emails as well as members into Inertia props. Any employee who belongs to the organization can read pending invitation email addresses and members through the serialised inertia data in the team page body even though the same user is forbidden from the API. This issue has been patched in version 0.12.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T18:11:31.930Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-33xq-wf67-c7vh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-33xq-wf67-c7vh"
        },
        {
          "name": "https://github.com/solidtime-io/solidtime/releases/tag/v0.12.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.12.2"
        }
      ],
      "source": {
        "advisory": "GHSA-33xq-wf67-c7vh",
        "discovery": "UNKNOWN"
      },
      "title": "Solidtime team page exposes pending invitation and member emails to employees who lack invitations:view/members:view permission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47236",
    "datePublished": "2026-06-12T18:11:31.930Z",
    "dateReserved": "2026-05-18T22:54:18.271Z",
    "dateUpdated": "2026-06-15T13:09:55.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42279",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T10:38:02.981878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T10:38:51.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "solidtime",
          "vendor": "solidtime-io",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.12.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller\u0027s organization. This issue has been patched in version 0.12.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T03:57:31.727Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr"
        },
        {
          "name": "https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c"
        },
        {
          "name": "https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1"
        }
      ],
      "source": {
        "advisory": "GHSA-pmf9-pxq9-ccwr",
        "discovery": "UNKNOWN"
      },
      "title": "solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42279",
    "datePublished": "2026-05-08T03:57:31.727Z",
    "dateReserved": "2026-04-26T11:53:27.716Z",
    "dateUpdated": "2026-05-08T10:38:51.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33345",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T13:21:15.653150Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T13:21:58.960Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "solidtime",
          "vendor": "solidtime-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-24T19:30:27.471Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm"
        },
        {
          "name": "https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209"
        },
        {
          "name": "https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6"
        }
      ],
      "source": {
        "advisory": "GHSA-354j-rx28-jjxm",
        "discovery": "UNKNOWN"
      },
      "title": "solidtime vulnerable to IDOR in private projects"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33345",
    "datePublished": "2026-03-24T19:30:27.471Z",
    "dateReserved": "2026-03-18T22:15:11.813Z",
    "dateUpdated": "2026-03-25T13:21:58.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}