Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: puemos Clear all filters
TI-2026-75083 CVE-2026-111349

Missing authorization in Craftplan CRM lets anyone add customers

Priority MEDIUM 64

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00374 Published 2026-10-15 No fix listed CWE-862
TI-2026-53709 CVE-2026-76876 · GHSA-q329-hwc8-2x8j

Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Priority LOW 36

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00445 Published 2026-08-21 Fixed in 0.5.1 CWE-862