Export limit exceeded: 415092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (2 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110629 | 1 Venturedrake | 1 Laravel-crm | 2026-10-26 | 6.5 Medium |
| VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices. | ||||
| CVE-2026-110630 | 1 Venturedrake | 1 Laravel-crm | 2026-10-26 | 6.5 Medium |
| VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method. | ||||
Page 1 of 1.