Threat database

CVE-2026-115998 is an Insecure Direct Object Reference (IDOR) vulnerability in CervantesSec cervantes version v1.3-beta. It allows an authenticated attacker to access sensitive data such as findings, proof-of-concept details, credentials, and client information from projects they do not belong to. The attacker can also modify finding statuses and transfer findings to their own projects, impacting data confidentiality and integrity.

CVE-2026-115994 is an authorization bypass vulnerability in CervantesSec cervantes version v1.3-beta. It allows an attacker with limited privileges to modify or delete targets belonging to other projects without proper authorization. This compromises the integrity of penetration testing scopes, results, and associated security reports. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

CVE-2026-115993 is a stored cross-site scripting (XSS) vulnerability in the Notes field of the Checklists feature in Cervantes version v1.3-beta. This flaw allows an attacker to inject malicious scripts that execute in another user's browser with elevated privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation information is currently available, and there are no known exploits in the wild.

CVE-2026-115975 is a broken access control vulnerability in the JiraController component of CervantesSec's cervantes product version v1.3-beta. This flaw allows an attacker with some privileges to create, edit, or delete Jira tickets related to vulnerabilities in projects they should not have access to. The vulnerability has a high severity rating with a CVSS score of 7.1.