https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-119736/https://vulnfeed.org/cve/CVE-2026-119736/Mon, 02 Nov 2026 19:18:02 +0000Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.https://vulnfeed.org/cve/CVE-2026-119734/https://vulnfeed.org/cve/CVE-2026-119734/Mon, 02 Nov 2026 18:58:31 +0000Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.https://vulnfeed.org/cve/CVE-2026-119733/https://vulnfeed.org/cve/CVE-2026-119733/Mon, 02 Nov 2026 18:57:18 +0000Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.https://vulnfeed.org/cve/CVE-2026-119732/https://vulnfeed.org/cve/CVE-2026-119732/Mon, 02 Nov 2026 18:56:12 +0000Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.https://vulnfeed.org/cve/CVE-2026-119731/https://vulnfeed.org/cve/CVE-2026-119731/Mon, 02 Nov 2026 18:54:28 +0000Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.