{"items":[{"id":"CVE-2026-108720","published":"2026-10-11T12:19:31.281Z","updated":"2026-10-13T13:17:08.960Z","title":"phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages","severity":"MEDIUM","score":5.3,"vendor":"phpipam","product":"phpipam","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-97818","published":"2026-09-25T04:44:18.843Z","updated":"2026-09-25T13:53:51.123Z","title":"phpIPAM through 1.8.3 has incorrect authorization for id==\"admins\" and id==\"all\" in api/controllers/User.php.","severity":"HIGH","score":8.6,"vendor":"phpipam","product":"phpIPAM","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-67602","published":"2026-08-24T13:57:42.191Z","updated":"2026-10-01T15:20:18.449Z","title":"phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache","severity":"CRITICAL","score":9.3,"vendor":"phpipam","product":"phpipam","kev":false,"epss":0.0064,"kevAdded":null},{"id":"CVE-2026-75105","published":"2026-08-17T20:36:01.403Z","updated":"2026-09-24T14:19:18.272Z","title":"phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter","severity":"HIGH","score":8.7,"vendor":"phpipam","product":"phpipam","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2026-12194","published":"2026-07-04T06:54:21.815Z","updated":"2026-07-06T18:32:12.392Z","title":"PHPIPAM Authenticated LFI","severity":"LOW","score":2.3,"vendor":"phpipam","product":"phpipam","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2024-55093","published":"2025-03-31T00:00:00.000Z","updated":"2025-03-31T13:41:23.227Z","title":"phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.","severity":"MEDIUM","score":5.4,"vendor":"phpIPAM","product":"phpIPAM","kev":false,"epss":0.00245,"kevAdded":null}]}