Veille CVE

Mardi 20 octobre 2026

1 CVE

Critique 0 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « CodeWithCJ SparkyFitness » ✕
  1. CVE-2026-113612 5.4 Moyenne

    CodeWithCJ SparkyFitness

    SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.