2026

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation

IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorize

IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 th

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow a

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user act

The vulnerability arises when the system fails to properly validate the 'email' field during the authentication process,

Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and p

The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters a

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlas

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel o

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administra

AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reac

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e4

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorizat

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong ent

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The af

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishe

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR au

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endp

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the da

An HTML injection vulnerability exists in the Google Chat webhook notification  sent by Thinkst Applied Research Canaryt

Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assig

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach uni

IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler

IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerab

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a pri

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authen

Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (i

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for th

An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using

Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be

EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a s

EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attack

The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authenticatio

A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to an

A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticat

Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension componen

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.

Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clie

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name

An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommend

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new u