https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T04:51:30.135823+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-18749 CVE-2026-18749 — CVE-2026-18749 2026-10-06T04:51:30.578182+00:00

Affected: CERT/CC VINCE

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.