CVE-2026-115998 debrief based on the supplied source corpus. The Cervantes version v1.3-beta is vulnerable to IDOR, allowing authenticated attackers to access sensitive findings, modify finding statuses, and transfer findings to their own projects. This vulnerability compromises data confidentiality and integrity. Defenders responsible for Cervantes projects and data access controls should assess exposure [truncated]
CVE-2026-115994 debrief: Cervantes BOLA vulnerability allows unauthorized target tampering, impacting penetration testing scope integrity and security report accuracy. This vulnerability affects Cervantes version v1.3-beta, allowing attackers to modify or delete targets belonging to other projects without authorization. The Cervantes BOLA vulnerability has a CVSS score of 5.4 and a severity rating of MEDI [truncated]
A stored XSS vulnerability exists in the 'Notes' field of Cervantes checklists version v1.3-beta. This could allow an attacker to execute arbitrary code in another user's browser with elevated privileges. The vulnerability is particularly concerning for defenders responsible for Cervantes installations, especially those with elevated privileges, as it could lead to potential code execution in user browser [truncated]
A CVE record for a vulnerability in Cervantes version v1.3-beta was published. The vulnerability is related to broken access control in JiraController, which could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects. This issue requires immediate attention from defenders responsible for Cervantes deployments to assess exposure and verify affected versions and co [truncated]
