product: WebSphere Extreme Scale

vendor: IBM

status: affected

version_type: semver

ecosystem: software/application

metric_type: Primary

severity: medium

part: a

vendor: ibm

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to improper validation in the XDF decoder. The application processes deeply nested Protocol Buffers messages and attacker-controlled length prefixes without sufficient bounds checking, which may allow an attacker on the same network to trigger a StackOverflowError or OutOfMemoryError, resulting in a crash of the WebSphere Application Server JVM.

title: Ibm Websphere Extreme Scale security vulnerability


default_status: unaffected

vendor: TONNET

version_type: custom

metric_type: Secondary

severity: high

status: Deferred

summary: E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

title: Tonnet Tpr7308 security vulnerability


product: WebSphere Application Server

less_than_or_equal: 7.0.2 Interim Fix 035

less_than_or_equal: 7.0.3 Interim Fix 017

archetype: ssrf

severity: critical

summary: IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.


default_status: unknown

product: HCL Notes

vendor: HCL Software

ecosystem: javascript/npm

status: Awaiting Analysis

summary: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting (XSS). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user. This issue affects HCL Notes: Release 12.0.2FP5HF8 on Linux 4.18.0-553.52.1.El8_10.X64_64#1.

title: Hcl Software Hcl Notes security vulnerability


product: Page-list

vendor: webvitaly

ecosystem: php/wordpress

summary: The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist_unqprfx_ext_shortcode() function (the [pagelist_ext] / [pagelistext] shortcode) accepting attacker-controlled post_status, post_type, and show_meta_key attributes and passing them directly into get_pages() and get_post_meta() with no capability check verifying that the rendering user is permitted to read the matched objects. When the current post has no child pages, the shortcode re-issues the query with child_of => 0, broadening it to every page on the site matching the supplied status/type. This makes it possible for authenticated attackers, with contributor-level access and above, to disclose the titles, body content/excerpts, and arbitrary post meta of unrelated private and draft pages by inserting the shortcode into a contributor-authored draft and previewing it.


vendor: CodeRevolution

summary: The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.

title: Coderevolution Crawlomatic Multipage Scraper Post Generator security vulnerability


product: Boost

vendor: PixelYourSite

summary: The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Pixelyoursite Boost security vulnerability


vendor: metaphorcreations

summary: The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys — including drafts, pending, scheduled, and disabled entries — by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a 'publish' post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted.

title: Metaphorcreations Ditty – Responsive News Tickers, Sliders, And Lists security vulnerability


product: Bogo

vendor: rocklobsterinc

summary: The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_translation. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the raw title, content, excerpt, and password of any private, draft, or password-protected post by triggering its duplication via the translation endpoint and reading the returned title.raw, content.raw, and excerpt.raw fields of the duplicated post. This vulnerability is exploitable against posts written in a non-default locale, as authenticated subscribers can request a translation into the site's default locale to pass the locale-only permission gate. While subscribers can trigger the endpoint, this is only impactful at the Contributor-level as they can actually read the duplicated content.

title: Rocklobsterinc Bogo security vulnerability


product: WP Promoter

vendor: rahulbhangale

summary: The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3. The function is hooked to both the wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options.

title: Rahulbhangale Wp Promoter security vulnerability


vendor: equalizedigital

summary: The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.42.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the ignore state, ignore reason, and ignore comment of arbitrary accessibility issues across the entire site — including mass modification of all rows sharing an 'object' identifier when largeBatch=true is supplied — corrupting accessibility audit integrity by hiding or dismissing findings outside their authorization scope.

title: Equalizedigital Equalize Digital Accessibility Checker – Wcag, Ada, Eaa… security vulnerability


vendor: qriouslad

archetype: generic

summary: The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the `log_js_errors()` AJAX handler being registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and gated only by a nonce that is publicly disclosed in every front-end page's HTML through `wp_localize_script()` whenever JavaScript error logging is enabled, providing no real authorization barrier. This makes it possible for unauthenticated attackers to inject arbitrary forged entries into the site's WordPress debug log by supplying attacker-controlled values for the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` fields — enabling spoofing of error and incident records, obscuring malicious activity within fabricated log noise, and misleading administrators who rely on the log for triage. This vulnerability is only exploitable when the plugin's JavaScript error logging feature is enabled, as the requisite nonce is only published into the page HTML under that condition.

title: Qriouslad Debug Log Manager – Conveniently Monitor And Inspect Errors security vulnerability


vendor: webaways

summary: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users, and cause the site to dispatch attacker-controlled email content to attacker-chosen recipient addresses.

title: Webaways Nex-Forms – Ultimate Forms Plugin For Wordpress security vulnerability


vendor: themewant

summary: The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the `easyel_handle_register()` function. This is due to the `wp_ajax_nopriv_eel_register` AJAX handler iterating the attacker-controlled `custom_meta` POST array and writing every supplied key-value pair to the newly created user's meta via `update_user_meta()` without any key whitelist or blocklist, allowing the `wp_capabilities` user meta key to be overwritten after `wp_insert_user()` has already assigned a safe role. This makes it possible for unauthenticated attackers to register a new account with full administrator-level privileges by supplying `custom_meta[wp_capabilities][administrator]=1`. Exploitation requires that user registration is enabled on the site and that at least one page exposes the Login/Register widget, which publishes the required `easy_elements_nonce` into the page DOM where it can be retrieved by any unauthenticated visitor via a simple GET request.

title: Themewant Easy Elements For Elementor – Addons & Website Templates security vulnerability


product: Easy Image Collage

vendor: brechtvds

summary: The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress's unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone.

title: Brechtvds Easy Image Collage security vulnerability


product: Easy Invoice – Invoice Generator, PDF Quotes & Payments

vendor: matrixaddons

summary: The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes — and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) — by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.


product: Splide Carousel Block

vendor: dkjensen

summary: The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload must be published before it executes for site visitors, which requires an editor or administrator to approve and publish the contributor's post.

title: Dkjensen Splide Carousel Block security vulnerability


product: DELMIA Service Process Engineer

vendor: Dassault Systèmes

less_than_or_equal: 3DEXPERIENCE R2024x FP.CFA.2537

version: Release 3DEXPERIENCE R2024x Golden

less_than_or_equal: 3DEXPERIENCE R2025x FP.CFA.2541

version: Release 3DEXPERIENCE R2025x Golden

version: Release 3DEXPERIENCE R2026x Golden

version_end_including: 3DEXPERIENCE R2024x FP.CFA.2537

summary: A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary script code in user's browser session.

title: Dassault Systèmes Delmia Service Process Engineer security vulnerability


product: CorvusPay WooCommerce Payment Gateway

vendor: corvusinfo

summary: The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The `corvuspay_success_handler` function registers the REST endpoint `POST /wp-json/corvuspay/success/` with `'permission_callback' => '__return_true'`, and while it calls `$this->client->validate->signature()` and stores the boolean result in `$res`, the result is never evaluated in a conditional — it is only written to the debug log — causing execution to unconditionally reach `$order->payment_complete()` regardless of whether the cryptographic signature is valid. This makes it possible for unauthenticated attackers to mark any pending WooCommerce order as fully paid by sending a POST request to the success endpoint containing an arbitrary or forged signature value, allowing them to obtain goods or services without payment. Because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the `order_number` POST parameter, requiring no prior knowledge of the victim order.

title: Corvusinfo Corvuspay Woocommerce Payment Gateway security vulnerability


summary: The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.


product: Grafana OSS

vendor: Grafana

author: Codex

description: CVE-2026-9029 is a sanitize-then-interpolate XSS in Grafana geomap XYZ tiles. GHSA names no version range and no floor. Do not copy a Grafana tag from CVE-2026-28381.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-9029: Grafana Geomap XSS, No Named Floor

product: grafana

vendor: grafana

recipe_kind: markdown-draft

status: Modified

summary: A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

title: Grafana security vulnerability


product: Archer A6 v4

vendor: TP-Link Systems Inc.

summary: A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot.

title: Tp-Link Systems Inc. Archer A6 V4 security vulnerability


summary: An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition.


product: ER7212PC v2

vendor: TP-Link Systems Inc

product: ER706W v1

product: ER706WP-4G v1

product: ER703WP-4G-Outdoor v1

status: Received

summary: An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

title: Tp-Link Systems Inc. Er7212Pc V2 security vulnerability


product: Aspera High-Speed Transfer Endpoint

vendor: IBM

less_than_or_equal: 4.4.7 Fix Pack 1

product: Aspera High-Speed Transfer Server

vendor: ibm

summary: IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.

title: Ibm Aspera High-Speed Transfer Endpoint security vulnerability


vendor: XCharge

summary: A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.

title: Xcharge C6 security vulnerability


summary: A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently validated, memory corruption may occur, which can lead to execution of unauthorized code with elevated privileges.

title: Xcharge C6 security vulnerability


summary: A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.

title: Xcharge C6 security vulnerability


product: AXE75 V1

ecosystem: operating-system

part: o

vendor: tp-link

summary: An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.


vendor: Lenovo

ecosystem: windows/system

summary: During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

title: Lenovo Accessories And Display Manager For Enterprise security vulnerability


product: Legion Zone

product: App Store

summary: A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code.

title: Lenovo Legion Zone security vulnerability


product: Server

vendor: Devolutions

vendor: devolutions

summary: Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0

title: Devolutions Devolutions Server security vulnerability


product: Slider Revolution

vendor: Revolution Slider

summary: The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.full' AJAX Action. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw social media API credentials: the Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID, stored in any configured slider's settings.

title: Revolution Slider Slider Revolution security vulnerability


summary: The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to deactivate any active plugin installed on the site.


product: SystemLink Enterprise

vendor: NI

summary: There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure. Successful exploitation requires an attacker to send a specially crafted HTTP request. This vulnerability affects NI SystemLink Enterprise 2026-04 and prior versions.

title: Ni Systemlink Enterprise security vulnerability


platforms:
x86
32 bit
64 bit

version_type: git

summary: Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element.


platforms:
x86
ARM
64 bit
32 bit

summary: An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic.


default_status: affected

product: Talend Administration Center

vendor: Talend

summary: A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user.


summary: A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio update URL. This issue was resolved in a patch, which is already available.

title: Talend Talend Administration Center security vulnerability


product: Szafir SDK

vendor: Krajowa Izba Rozliczeniowa

summary: For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified". For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined". This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation: (1) in use-cases other than qualified certificate authentication, or (2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application. This issue was fixed in version 1.8.463.2.

title: Krajowa Izba Rozliczeniowa Szafir Sdk security vulnerability


product: NextGEN Gallery

vendor: awesomemotive

version: O

summary: NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.

title: Awesomemotive Nextgen Gallery security vulnerability


product: Red Hat Directory Server 11.5 E4S for RHEL 8

vendor: Red Hat

status: unaffected

version_type: rpm

product: Red Hat Directory Server 11.7 E4S for RHEL 8

product: Red Hat Directory Server 11.9 for RHEL 8

product: Red Hat Directory Server 12.2 E4S for RHEL 9

product: Red Hat Directory Server 12.4 E4S for RHEL 9

product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 10.0 Extended Update Support

product: Red Hat Enterprise Linux 7 Extended Lifecycle Support

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

description: CVE-2026-9064 is unbounded LDAP controls in 389-ds-base get_ldapmessage_controls_ext(). GHSA-7r3c-wfgh-x96c names no version range and no floor.

title: CVE-2026-9064: 389-ds LDAP Controls, No Named Floor

vendor: redhat

summary: A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

title: A flaw was found in 389-ds-base


product: Surecart

vendor: brainstormforce

summary: SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'. The root cause is a flawed escaping bypass in the query builder ('wp-query-builder'). Values passed to the 'where()' method are only sanitized via '$wpdb->prepare()' when they do **not** contain a dot ('.') or the WordPress table prefix ('wp_'). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the 'WHERE' clause, allowing full UNION-based extraction of the database.

title: Brainstormforce Surecart security vulnerability


product: WP Compress

vendor: Unknown

summary: The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.

title: Wp Compress security vulnerability


product: Schema & Structured Data for WP & AMP

summary: The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.

title: Schema & Structured Data For Wp & Amp security vulnerability


product: WebSphere Application Server

product: WebSphere Application Server - Liberty

summary: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

title: Ibm Websphere Application Server security vulnerability


description: CVE-2026-9072 is RCE/DoS in the WebSphere Web Server Plug-in when Intelligent Management is used. Apply APAR PH71376 or Fix Pack 9.0.5.28+ / 8.5.5.30+. Do not attack the plug-in.

title: CVE-2026-9072: WebSphere Plug-in Intelligent Management RCE

product: i

summary: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

title: Ibm I security vulnerability


product: Red Hat Satellite 6.18

product: Red Hat Satellite 6.19

product: satellite

product: foreman

vendor: theforeman

summary: A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.

title: A flaw was found in foreman-mcp-server


product: API Connect

vendor: IBM

description: CVE-2026-9074 is an unauthenticated SQL injection in IBM API Connect password reset. Upgrade 10.0.8.0–10.0.8.9 to 10.0.8.10+ and 12.1.0.0–12.1.0.3 to 12.1.1.0+.

title: CVE-2026-9074: IBM API Connect Password-Reset SQLi

summary: IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

title: Ibm Api Connect security vulnerability


product: OpenSSL

vendor: OpenSSL

product: openssl

vendor: openssl

summary: Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen.

title: Openssl security vulnerability


product: Langflow OSS

product: langflow

vendor: langflow

summary: IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

title: Langflow security vulnerability


ecosystem: browser

product: firefox

vendor: mozilla

status: Undergoing Analysis

summary: Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

title: Mozilla Firefox security vulnerability


product: curl

vendor: curl

vendor: haxx

summary: libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

title: Haxx Curl security vulnerability


summary: Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

title: Haxx Curl security vulnerability


summary: IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses).

title: Langflow security vulnerability


product: Drupal core

vendor: Drupal

known_ransomware_campaign_use: Unknown

product: Core

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: Drupal

vulnerability_name: Drupal Core SQL Injection Vulnerability

content_markdown:
CVE-2026-9082 is an SQL-injection vulnerability in Drupal core's database
abstraction API. Drupal's security team states that an anonymous attacker can
send crafted requests that cause arbitrary SQL injection when a site uses
PostgreSQL. Impact can include information disclosure and, in some cases,
privilege escalation or remote code execution. The advisory was updated on
May 22, 2026 after exploit attempts were detected in the wild. CISA added the
CVE to its Known Exploited Vulnerabilities catalog that day with a May 27,
2026 remediation due date for agencies subject to BOD 22-01.

Do not validate this finding by sending a payload. Establish applicability from
the installed Drupal core version, the runtime database driver, deployment
inventory, and the official version boundaries. Then update through the
repository's normal dependency-release process and verify the deployed result.

## Evidence basis and limits

I reviewed Drupal security advisory SA-CORE-2026-004, live GHAD
`GHSA-ghwc-95x2-682j`, the CISA KEV data in the NVD record, and the official
Composer and Drush command documentation. Live GHAD first_patched
`10.4.10 / 10.5.10 / 10.6.9 / 11.1.10 / 11.2.12 / 11.3.10` matches NVD
excludes and vendor SA-CORE-2026-004. I did not access or test a live Drupal
site, inspect a site's database or logs, execute crafted input, or validate
an update. The Drupal advisory remains authoritative for the affected ranges
and branch-specific fixes.

The SQL-injection path applies only to sites using PostgreSQL. Drupal also says
the fixed releases contain third-party Symfony and Twig security updates that
apply more broadly, so a non-PostgreSQL site should not automatically discard
the update. This recipe scopes the exposure decision for CVE-2026-9082 and does
not claim to close those separate upstream findings.

## When to use this recipe

Use it when a repository, scanner result, asset inventory, or incident ticket
identifies Drupal core in the advisory's affected range and the task is scoped
to CVE-2026-9082. A repository may own Composer constraints and lockfiles,
container images, deployment manifests, inventory policy, tests, or release
runbooks for the affected application.

The exact SQL-injection exposure requires PostgreSQL. Do not use this recipe to
classify a non-PostgreSQL site as exposed to this CVE, send a crafted request,
probe a public site, inspect production data without authorization, or make an
unapproved dependency or production change.

## Inputs

- Composer lockfiles, `composer.json` constraints, container images, and
  deployment manifests that pin Drupal core.
- Runtime evidence of the installed core version and whether the site uses
  the PostgreSQL driver.
- Inventory of preview, standby, worker, and disaster-recovery copies.
- Approved upgrade path to a currently supported Drupal branch and the
  repository's test, backup, and rollback commands.
- Authorization and log coverage if the site was reachable while unpatched.

## Affected and fixed branches

| Drupal core branch or range | Vendor action in SA-CORE-2026-004 | Support note |
| --- | --- | --- |
| Drupal `8.9.x` | Manually apply the advisory's Drupal 8.9 patch only as an emergency bridge | End of life; migrate to a supported branch |
| Drupal `9.x` | Manually apply the advisory's Drupal 9.5 patch only as an emergency bridge | End of life; migrate to a supported branch |
| `>=10.0.0 <10.4.10` | Update to `10.4.10`, then migrate to a supported branch | 10.4 and earlier are end of life; the release is supplied on a best-effort basis |
| `>=10.5.0 <10.5.10` | `10.5.10` | Prefer the latest supported release allowed by the approved upgrade path |
| `>=10.6.0 <10.6.9` | `10.6.9` | Prefer the latest supported release allowed by the approved upgrade path |
| `>=11.0.0 <11.1.10` | `11.1.10` | 11.0 and 11.1 are end of life; migrate to a supported branch |
| `>=11.2.0 <11.2.12` | `11.2.12` | Prefer the latest supported release allowed by the approved upgrade path |
| `>=11.3.0 <11.3.10` | `11.3.10` | Prefer the latest supported release allowed by the approved upgrade path |

The listed releases are historical minimums for this CVE, not a reason to
remain on an obsolete branch. Live GHAD first_patched matches those same
floors. The Drupal 8 and 9 patches are not fixed releases and do not restore
vendor support; Drupal warns that unsupported versions still contain other
previously disclosed vulnerabilities. Drupal's advisory identifies 11.3,
11.2, 10.6, and 10.5 as supported branches at publication. Resolve the
current supported destination from Drupal before changing dependencies.

## How to determine exposure safely

1. Find every Drupal application, tenant, immutable image, scheduled worker,
   preview environment, standby deployment, and disaster-recovery artifact.
2. Record the installed core version from the lockfile, built artifact, and
   running application. Do not rely on only `composer.json` constraints.
3. Establish the runtime database driver from approved deployment inventory or
   an authenticated status command. Do not print database URLs, passwords, or
   secret-backed settings into logs or a pull request.
4. Classify the exact injection exposure as affected only when the running core
   version is in an affected range and the site uses PostgreSQL. Version or
   driver uncertainty must remain open.
5. Record internet, partner, and internal reachability during the vulnerable
   period and preserve application, reverse-proxy, WAF, database, identity, and
   deployment logs according to incident policy.

Useful read-only inventory in an authorized repository or application shell
may include:

```bash
composer show --locked drupal/core-recommended
composer show --locked drupal/core
drush status --fields=drupal-version,db-driver
```

Not every project installs `drupal/core-recommended`, and not every environment
has Drush. Treat a missing command as an inventory limitation, not proof that
Drupal or PostgreSQL is absent. Redact secret-bearing output before attaching
evidence.

## Immediate containment

For an affected PostgreSQL deployment that cannot be updated immediately,
have the application and network owners restrict untrusted reachability or
place the service into an approved maintenance state. Drupal's advisory does
not publish a configuration workaround, so containment is temporary and must
not be represented as the fix.

Preserve evidence before cache rebuilds, dependency updates, restarts, or log
rotation. When an affected public site had exposure during the vulnerable
period, notify the incident-response owner. A successful update does not prove
that earlier SQL injection did not occur.

## How to remediate CVE-2026-9082

1. Select a currently supported Drupal branch and a release at or above the
   applicable fixed floor. For an EOL branch, plan the supported migration; use
   the advisory's best-effort legacy patch only as a documented emergency
   bridge when the owner approves the residual risk.
2. Update the repository's Drupal core constraints and lockfile through its
   established Composer workflow. Preserve the package source, resolved
   versions, lockfile diff, and integrity metadata.
3. Review transitive Symfony and Twig changes, contributed-module constraints,
   PHP compatibility, database migrations, patches, and deployment hooks.
4. Run the existing unit, integration, kernel, functional, static-analysis,
   Composer audit, and application smoke tests. Add a regression test only when
   it can exercise sanitized query behavior without reproducing an exploit.
5. Back up the database and files through the approved recovery process, stage
   the deployment, and keep production database updates and traffic changes
   under the service owner's authority.
6. Deploy every web, worker, CLI, cron, preview, and standby artifact from the
   same reviewed lockfile. Remove vulnerable images and restoration paths.

Do not hand-edit Drupal core or add a request deny list as the permanent fix.
Do not run untrusted SQL, copy a proof of concept into tests, or use production
data to demonstrate exploitability.

## How to verify remediation

- Confirm the running version on every deployment is at or above the fixed
  floor for its branch and that the branch remains vendor-supported.
- Match the deployed artifact and lockfile digest to the reviewed build.
- Confirm no old image, pod, worker, preview environment, standby, snapshot, or
  rollback package can re-enter service.
- Run authenticated application health checks for ordinary anonymous pages,
  forms, search, administration, queues, cron, and PostgreSQL-backed workflows.
- Re-run the approved dependency and vulnerability scanners without suppressing
  a conflicting result.
- Record application version, database driver, artifact identity, environment,
  verifier, timestamp, and test evidence.

If the site previously ran an affected version on PostgreSQL, patch
verification and incident assessment are separate decisions. Let incident
response determine database-log review, credential rotation, rebuild, and any
notification obligations.

## Agent prompt

~~~markdown
You are remediating exactly CVE-2026-9082 in a Drupal repository. Return one
reviewer-ready change set or TRIAGE.md.

1. Inventory every deployed copy and record the running Drupal core version,
   database driver, artifact, owner, and reachability. Do not expose secrets.
2. Compare the exact version with SA-CORE-2026-004. The injection path requires
   PostgreSQL, but the release also includes separate dependency security fixes.
3. Select a current supported branch at or above its fixed version. Update the
   Composer constraints and lockfile through the repository's normal workflow.
4. Review transitive changes and run the existing tests, Composer audit, and
   benign application health checks. Do not include or execute exploit input.
5. Document staging, database backup, production-owner approval, rollback,
   per-deployment version verification, stale-image removal, and residual risk.

Do not deploy, alter production traffic, run database updates, scan public
systems, execute crafted requests, or suppress findings without authorization.
Do not claim that a patched version proves no prior compromise.

Stop with TRIAGE.md when the exact version, PostgreSQL use, complete deployment
scope, supported upgrade path, lockfile ownership, test coverage, backup,
rollback, exposure history, or production authority cannot be established.
~~~

## Rollback and stop conditions

Rollback must restore the recorded application artifact and compatible
database state through the existing recovery process. If that artifact is
vulnerable, keep the service under approved containment and escalate a forward
fix. Never make an affected build publicly reachable merely to recover service.

Stop and write `TRIAGE.md` when:

- the running core version, database driver, fleet scope, or artifact identity
  is unknown;
- the repository cannot safely resolve a supported fixed branch;
- contributed modules, PHP, Symfony, Twig, or database changes exceed scope;
- an affected public deployment lacks adequate historical logs;
- suspicious database or application activity is found;
- production backup, rollout, or rollback lacks an authorized owner; or
- verification would require an SQL-injection payload.

## Output contract

Return one reviewer-ready CVE-2026-9082 change or `TRIAGE.md`. The change must
include application inventory, before/after core versions, database driver,
Composer and artifact evidence, test results, exposure and incident handoff,
deployment and stale-image verification, rollback, and residual risk. No
secrets, production data, exploit material, or unsupported clean claims.

## Primary references

- [Drupal SA-CORE-2026-004](https://www.drupal.org/sa-core-2026-004)
- [GitHub Advisory GHSA-ghwc-95x2-682j](https://github.com/advisories/GHSA-ghwc-95x2-682j)
- [CISA Known Exploited Vulnerabilities entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082)
- [NVD record for CVE-2026-9082](https://nvd.nist.gov/vuln/detail/CVE-2026-9082)
- [Composer `show` documentation](https://getcomposer.org/doc/03-cli.md#show-info)
- [Composer `audit` documentation](https://getcomposer.org/doc/03-cli.md#audit)
- [Drush `core:status` command](https://www.drush.org/13.x/commands/core_status/)

## Related workflow

- [Vulnerable Dependency Remediation]({{< relref "/security-remediation/vulnerable-dependencies" >}})
- [How to remediate vulnerabilities with AI agents]({{< relref "/security-remediation" >}})

description: Remediate CVE-2026-9082 Drupal core PostgreSQL SQLi. GHAD first_patched 10.4.10 / 10.5.10 / 10.6.9 / 11.1.10 / 11.2.12 / 11.3.10 matches NVD.

maturity: stable

model: GPT-5.6 Codex

title: CVE-2026-9082 - Drupal core PostgreSQL SQL injection

product: drupal

vendor: drupal

quality: curated

recipe_kind: markdown-override

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

title: Drupal Core SQL Injection Vulnerability


product: Red Hat build of Keycloak 26.4

product: Red Hat build of Keycloak 26.6

summary: A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

title: A flaw was found in Keycloak


product: misp

vendor: misp

summary: MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

title: Misp security vulnerability


product: Pardus-Parental-Control

summary: Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.

title: Tubitak Bilgem Software Technologies Research Institute Pardus-Parental… security vulnerability


description: CVE-2026-9086 lets a manage-client admin bypass Keycloak client URI checks (XSS via case-insensitive validation). Upgrade to 26.6.4+ or RHBK 26.4.14+ / 26.6.4+. Not an npm package.

title: CVE-2026-9086: Keycloak Client URI Validation Bypass

summary: A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

title: A flaw was found in Keycloak


summary: A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

title: A flaw was found in Keycloak


product: Automate

vendor: ConnectWise

version: All versions prior to 2026.5

product: automate

vendor: connectwise

summary: The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.

title: Connectwise Automate security vulnerability


product: Casdoor

vendor: Casdoor

summary: Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.

title: Casdoor security vulnerability


summary: Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this path is logged in without MFA enforcement.

title: Casdoor security vulnerability


summary: Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover. The getExistUserByBindingRule function matches users by email without checking the email_verified claim from upstream providers; the idp.UserInfo struct does not even include a EmailVerified field. An attacker can supply an unverified email claim from an upstream provider to take over accounts that use the same email address.


summary: In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.

title: Casdoor security vulnerability


description: CVE-2026-9094 is Casdoor GetTokenExchangeToken leftover. GHAD names 2.387.0. Leftover dump text named 2.387.0. Do not invent 2.387.1.

title: CVE-2026-9094: Casdoor GetTokenExchangeToken missing cross-org JWT check

summary: Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.


summary: Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.


summary: Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.


summary: Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.


summary: In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.

title: Casdoor security vulnerability


vendor: Red Hat

description: CVE-2026-9099 skips an authorization check on Keycloak GroupResource.addChild(), letting a limited group admin reparent groups. Upgrade to 26.6.4+ or RHBK 26.4.14+ / 26.6.4+.

title: CVE-2026-9099: Keycloak Group-Admin addChild Escalation

vendor: redhat

summary: A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group. Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.

title: A flaw was found in Keycloak


product: C Driver

vendor: MongoDB, Inc.

summary: The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).


product: Compass

summary: Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

title: Mongodb, Inc. Compass security vulnerability


product: Altium Enterprise Server

vendor: Altium

summary: A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem. Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service.

title: Altium Altium Enterprise Server security vulnerability


product: Langflow OSS

vendor: IBM

summary: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administrative access. Additionally, permissive cross-origin resource sharing (CORS) settings may allow tokens to be exposed to unintended origins, increasing the risk of unauthorized access.

title: Langflow security vulnerability


product: Draft List

vendor: dartiss

summary: The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unescaped injection path is triggered specifically when the viewing user lacks edit capabilities, meaning payloads embedded in draft post titles via attribute-breakout techniques execute for unauthenticated users and subscribers.

title: Dartiss Draft List security vulnerability


product: TL-WR841N v14

vendor: TP-Link Systems Inc.

vendor: tp-link

summary: An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker can send crafted HTTP requests to cause the embedded web server to overflow a stack buffer, resulting in a crash of the affected process. Successful exploitation results in a denial-of-service condition, causing the device to crash and automatically reboot.


product: Enterprise Server

vendor: GitHub

vendor: github

summary: A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.

title: Github Enterprise Server security vulnerability


vendor: wpchill

summary: The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_components]' parameter in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Wpchill Kali Forms — Contact Form & Drag-And-Drop Builder security vulnerability


product: Studio 5000 Logix Designer

vendor: Rockwell Automation

summary: A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.


vendor: john-dagelmore

summary: The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The deterministically derived API key (sha256 of the site URL) is printed in the HTML source of every page via the JavaScript variable gptApiKey, meaning any unauthenticated visitor can retrieve the key and submit malicious translation payloads to the /wp-json/gptranslate/v1/request endpoint without any additional precondition.

title: John-Dagelmore Gptranslate – Multilingual Ai Translation For Wordpress… security vulnerability


product: Chrome

vendor: Google

product: chrome

vendor: google

summary: Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


summary: Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


summary: Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


product: Presto Player

summary: The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url shortcode attribute directly into the overlay configuration without scheme validation, allowing javascript: URIs to survive and be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: 2Winfactor Presto Player security vulnerability


summary: Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.


summary: A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

title: Rockwell Automation Studio 5000 Logix Designer security vulnerability


summary: A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path (such as an encoded drive letter) in a Viewer storage API request, causing the configured storage root to be discarded and allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores database credentials, signing key locations, certificate passwords, and OAuth secrets, exploitation can lead to disclosure of all server secrets and full compromise of the server and its data. Cloud deployments are not affected, as they use object storage and do not enable this component.


product: langflow

vendor: langflow

summary: IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.

title: Langflow security vulnerability


summary: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.


product: RabbitMQ AWS

vendor: AWS

summary: Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. To remediate this issue, customers should upgrade to version 0.2.1 of rabbitmq-aws. If RabbitMQ is configured to use TLS for connections, we also recommend rotating any associated private certificate keys.


product: Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel

vendor: fooplugins

summary: The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and including, 3.1.31 This is due to an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function, which blocks only a subset of HTML event attributes (onmouseover, onmouseout, onpointerenter, onclick, onload, onchange, onerror) while permitting others such as 'onmouseenter', combined with the failure to escape the attribute key when building the gallery container HTML in foogallery_build_container_attributes_safe(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Fooplugins Photo Gallery By Foogallery : Responsive Image Gallery, Maso… security vulnerability


ecosystem: python/pypi

summary: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows.

title: Langflow security vulnerability


product: misp

vendor: misp

vendor: misp-project

summary: A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update an existing record, an authenticated user able to submit shadow attribute proposals could provide the identifier of an existing ShadowAttribute and cause that record to be updated instead of creating a new proposal. This can result in unauthorized modification of existing shadow attributes, potentially affecting proposals associated with events the user should not be able to alter. Depending on deployment configuration and accessible API responses, the issue may also expose or move proposal data across event contexts. The vulnerability is caused by trusting a client-supplied primary key during object creation. The fix removes the id field from incoming ShadowAttribute data before processing, ensuring that the endpoint always creates a new proposal rather than updating an existing one. This has been fixed in MISP 2.5.38.


summary: The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding.


product: AG1000-01A SMS Alert Gateway

vendor: Taiko Network Communications Pte Ltd.

version: Rev 7.3

version: Rev 8

summary: Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.

title: Taiko Network Communications Pte Ltd. Ag1000-01A Sms Alert Gateway security vulnerability


summary: A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover.


summary: Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. Attackers with network access can directly request internal resources such as index.zhtml, point.zhtml, and log.shtml to gain full administrative read and write access, enabling unauthorized modification of alarm routing, device configuration, and disruption of monitoring and control functions.


product: grpc-device

vendor: NI

product: InstrumentStudio

product: instrumentstudio

vendor: ni

summary: There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.

title: Ni Instrumentstudio security vulnerability


severity: low

summary: There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen. This may silently discard high bits if a size value exceeded the target type's range. This affects NI grpc-device 2.17.0 and prior versions.


summary: Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields. Attackers can bypass front-end length restrictions using JavaScript comments and template literals to concatenate executable script fragments that are rendered in administrative dashboard views such as index.zhtml, resulting in persistent script execution within administrative sessions.


vendor: crmperks

summary: The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() without validating that the value corresponds to a legitimately uploaded file — when no file is present in $_FILES, raw_value reflects the attacker-controlled POST string. copy() accepts both local filesystem paths and URL sources, so the attacker can target any file readable by the PHP process or supply an attacker-controlled remote URL. Elementor Pro is a prerequisite for triggering the code path (it owns the elementor_pro/forms/new_record hook and populates the Form_Record object), but the bug itself is entirely in Contact Form Entries' handler. This could allow unauthenticated attackers to disclose arbitrary files on the affected site's server.

title: Crmperks Database For Contact Form 7, Wpforms, Elementor Forms security vulnerability


product: uproot

vendor: scikit-hep

summary: uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source without safe quoting via repr() or the !r format specifier. An attacker who can supply a crafted ROOT file can place Python expression-breaking content into a streamer metadata field. When uproot generates and invokes the corresponding reader method, the injected Python expression is evaluated in the context of the process opening the file, resulting in arbitrary Python code execution in applications that open or process attacker-controlled ROOT files with affected uproot code paths.


product: Comments – wpDiscuz

vendor: advancedcoding

summary: The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and including, 7.6.56 This is due to insufficient output escaping in the getCommentAuthor() function, which interpolates the stored comment_author_url value directly into single-quoted HTML attributes without applying esc_url() or esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Advancedcoding Comments – Wpdiscuz security vulnerability


product: Red Hat Enterprise Linux 10

vendor: Red Hat

product: Red Hat Enterprise Linux 10.0 Extended Update Support

product: Red Hat Hardened Images

product: Red Hat Enterprise Linux 7

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 9

product: Red Hat OpenShift Container Platform 4

product: Red Hat Satellite 6

product: Red Hat Update Infrastructure 4 for Cloud Providers

product: libsolv

vendor: opensuse

vendor: redhat

product: satellite

summary: A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

title: A flaw was found in libsolv


summary: A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

title: A flaw was found in libsolv


product: Archer AX12 V1

vendor: TP-Link Systems Inc.

product: Archer AX18 v1

product: Archer AX17 v1

vendor: TP Link Systems Inc.

product: Archer AX1300 v1.6

summary: An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.


product: Altium 365

vendor: Altium

summary: A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries. Successful exploitation allows reading a workspace's indexed contents (such as component data, project and folder names, and user metadata) and injecting, modifying, or deleting search index entries. These operations affect the search index only, not the underlying vault data, but they can disclose sensitive workspace information and compromise the integrity and availability of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected.


product: InsightConnect Sed Plugin

product: sed

vendor: gnu

summary: Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parameter due to insufficient input validation.

title: Gnu Sed security vulnerability


summary: Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths via the expression parameter.

title: Gnu Sed security vulnerability


summary: OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expression parameter due to insufficient input validation.

title: Gnu Sed security vulnerability


product: Tanium Server

vendor: Tanium

product: server

vendor: tanium

summary: Tanium addressed a denial of service vulnerability in Tanium Server.


product: Web Fax

vendor: Gmission

summary: Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects Web Fax: from 3.0 before 3.1.


product: Eclipse 4diac

vendor: Eclipse Foundation

vendor: eclipse

summary: In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).

title: Eclipse 4Diac Forte security vulnerability


product: Mattermost

vendor: Mattermost

vendor: mattermost

summary: Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664

title: Mattermost Mattermost Server security vulnerability


product: Red Hat Advanced Cluster Security 4.9

product: Red Hat Advanced Cluster Security for Kubernetes 4.10

product: Red Hat Advanced Cluster Security for Kubernetes 4.11

part: redhat

summary: A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.


product: Arena SDK

vendor: LUCID Vision Labs

summary: DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a required dependency is not found locally.

title: Lucid Vision Labs Arena Sdk security vulnerability


product: HTTP Server

vendor: IBM

vendor: ibm

summary: IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.


product: PowerVM Novalink

summary: IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

title: Ibm Powervm Novalink security vulnerability


vendor: ajitdas

summary: The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due to a missing capability check on the delete_single_account() function in versions up to, and including, 1.2.0. The REST route 'devs-accounting/v1/delete-account/(?P<id>\d+)' is registered without any permission_callback, which causes WordPress to expose the endpoint to public, unauthenticated access. This makes it possible for unauthenticated attackers to soft-delete arbitrary accounting account records (wp_dac_accounts) by issuing a simple GET request to the endpoint with any account ID.

title: Ajitdas Devs Accounting – Simple Accounting And Invoicing Solution security vulnerability


summary: The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.0. This is due to the get_single_account() REST API callback being registered with a permission_callback that unconditionally returns true, providing no authentication or authorization checks on the /devs-accounting/v1/get-account/<id> endpoint. This makes it possible for unauthenticated attackers to read arbitrary private financial account records (including account name, bank name, and opening balance) by enumerating the numeric account ID, resulting in sensitive information disclosure.


product: SecureTransport

vendor: Axway

version_type: SecureTransport

ecosystem: java/maven

summary: A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

title: Axway Securetransport security vulnerability


product: WP Forms Connector

summary: The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/<id> (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID — including the WordPress password hash (user_pass) and email address — by sending a request with a valid administrator login name (commonly the default 'admin') and any arbitrary password value.


summary: The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() function, where the value is concatenated unquoted into the ORDER BY clause and executed via $wpdb->get_results() without $wpdb->prepare(). The endpoint is registered with permission_callback '__return_true' and performs only a broken header-based check that validates the supplied 'Username' corresponds to an administrator account while never verifying the 'Password'. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Hancock11 Wp Forms Connector security vulnerability


product: MotoPress Appointment Booking

vendor: jetmonsters

summary: The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the `POST /motopress/appointment/v1/bookings` REST endpoint being registered with `'permission_callback' => '__return_true'`, allowing unauthenticated access, while the `createBooking` handler in `BookingsRestController.php` accepts an attacker-supplied `payment_details.booking_id` value and loads the referenced booking via `findById()` without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and `customer_id` of any non-confirmed victim booking by submitting a request with no reservation items, causing `BookingService::createBooking()` to load the existing victim booking object and persist it with attacker-controlled customer data.

title: Jetmonsters Motopress Appointment Booking security vulnerability


platforms: Windows Linux

product: ArcGIS Server

vendor: Esri

description: CVE-2026-9181 is unauthenticated directory traversal on ArcGIS Server 12.0 and prior. GHSA last-names 12.0. Do not invent 12.1.

title: CVE-2026-9181: ArcGIS Server Traversal, 12.0

vendor: esri

summary: Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.


summary: Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.


product: 24liveblog – live blog tool

summary: The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to the lb24_block_enqueue_scripts() function being hooked to enqueue_block_editor_assets and, for any non-administrator user, falling back to loading the administrator-configured site-wide 24liveblog integration secrets (lb24_token, lb24_refresh_token, lb24_uid, lb24_uname) from the options table via get_option() and emitting them through wp_localize_script() as the lb24BlockData JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract third-party 24liveblog account credentials (including the API token and refresh token) by simply opening the block editor and inspecting the page source.

title: 24Liveblog 24Liveblog – Live Blog Tool security vulnerability


summary: The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_token() AJAX function in versions up to, and including, 2.2. The handler only verifies the 'lb24' nonce (which is generated and localized to any user with block editor access via lb24_block_enqueue_scripts()) and does not verify the user's capabilities or that the supplied user_id belongs to the current user. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values of any user (including administrators) as well as the corresponding site-wide options, effectively hijacking the plugin's integration with the 24liveblog service.


product: 6Storage Rentals

vendor: sixstorage

summary: The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the `userId` parameter of the `six_storage_get_user_info` and `six_storage_update_profile` AJAX actions. This is due to the `six_storage_getUserInfo()` and `six_storage_updateProfile()` functions being registered on `wp_ajax_nopriv_*` hooks and accepting a tenant identifier directly from `$_POST['userId']` without performing any ownership verification, session binding, or nonce validation to confirm the requester has a legitimate relationship to the supplied ID. This makes it possible for unauthenticated attackers to read and modify arbitrary tenants' profile data — including name, email address, phone number, physical address, and SSN — by supplying an enumerated `userId` value in a crafted request to either handler.

title: Sixstorage 6Storage Rentals security vulnerability