leepeuker movary

• CVE-2026-40350 High 8.8 Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts 0.4%
• CVE-2026-40349 High 8.8 Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true 0.5%
• CVE-2026-40348 High 7.7 Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing 0.4%
• CVE-2026-23841 Critical 9.3 Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param 0.3%
• CVE-2026-23840 Critical 9.3 Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param 0.3%
• CVE-2026-23839 Critical 9.3 Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param 0.3%
• CVE-2025-64115 Medium 5.1 Movary unvalidated Referer header allows open redirect and phishing 0.3%
• CVE-2025-64116 Medium 5.1 Movary vulnerable to an open redirect 0.3%