canove vulnerabilities

Products

• canove/whaticket-community 2

Latest canove CVEs

Newest publication first

1. CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup

   Published 2026-10-16

   Critical·CVSS 9.3 EPSS 0.58%

   WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, a...

2. CVE-2026-111709 WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId

   Published 2026-10-16

   Medium·CVSS 5.3 EPSS 0.22%

   WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.