https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 09:18:40 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-86176 <p>NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users&#39; private records through unscoped querysets, disclosing which users watch or bookmark which objects.</p> <p>NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users&#39; private records through unscoped querysets, disclosing which users watch or bookmark which objects.</p> https://db.gcve.eu/vuln/fkie_cve-2026-86176 https://db.gcve.eu/vuln/ghsa-mx7r-5p73-mr7p <p>NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users&#39; private records through unscoped querysets, disclosing which users watch or bookmark which objects.</p> <p>NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users&#39; private records through unscoped querysets, disclosing which users watch or bookmark which objects.</p> https://db.gcve.eu/vuln/ghsa-mx7r-5p73-mr7p