https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-47678/https://vulnfeed.org/cve/CVE-2026-47678/Wed, 04 Nov 2026 22:24:08 +0000GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.https://vulnfeed.org/cve/CVE-2026-52848/https://vulnfeed.org/cve/CVE-2026-52848/Wed, 04 Nov 2026 22:21:48 +0000GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.https://vulnfeed.org/cve/CVE-2026-57152/https://vulnfeed.org/cve/CVE-2026-57152/Wed, 04 Nov 2026 22:20:55 +0000GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.https://vulnfeed.org/cve/CVE-2026-121559/https://vulnfeed.org/cve/CVE-2026-121559/Tue, 03 Nov 2026 15:17:15 +0000GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.