Exploit for CVE-2026-96349

CVE-2026-96349 — WordPress SiteSkite ≤ 2.1.8 → unauthenticated...

CVE-2026-103534

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...

CVE-2026-103534

The David-Crty databasement software (versions up to 1.7.1 ) contains a vulnerability in the Snapshot Model component. Specifically, the SnapshotPolicy.viewAny/SnapshotPolicy.view functions within the /api/v1/snapshots file suffer from improper access controls . This flaw allows for remote exploi...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: commitizen, graalvm, gitlab-rails-ce, commercial-gitlab-rails-ee, kibana, authentik, unleash-fips, wazuh-dashboard, opensearch-dashboards, arangodb, wazuh-dashboard-fips, dotstatsuite-supercore, pelias-api, lambda-nodejs, unleash, foxx-cli, nextcloud-server, verdacci...

CVE-2026-102278 vulnerabilities

Vulnerabilities for packages: commitizen, graalvm, gitlab-rails-ce, commercial-gitlab-rails-ee, kibana, authentik, unleash-fips, wazuh-dashboard, opensearch-dashboards, arangodb, wazuh-dashboard-fips, dotstatsuite-supercore, pelias-api, lambda-nodejs, unleash, foxx-cli, nextcloud-server, verdacci...

GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: commitizen, graalvm, gitlab-rails-ce, commercial-gitlab-rails-ee, kibana, authentik, unleash-fips, wazuh-dashboard, opensearch-dashboards, arangodb, wazuh-dashboard-fips, dotstatsuite-supercore, pelias-api, lambda-nodejs, unleash, foxx-cli, nextcloud-server, verdacci...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: commitizen, graalvm, gitlab-rails-ce, commercial-gitlab-rails-ee, kibana, authentik, unleash-fips, wazuh-dashboard, opensearch-dashboards, arangodb, wazuh-dashboard-fips, dotstatsuite-supercore, pelias-api, lambda-nodejs, unleash, foxx-cli, nextcloud-server, verdacci...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533

A path traversal vulnerability exists in the database-servers API Endpoint of David-Crty databasement versions up to 1.7.1 . The flaw is located in the app/Http/Requests/Api/V1/RestoreRequest.php file and stems from the improper handling of the schema_name argument. An attacker can potentially la...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

SUSE CVE-2026-13719

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

SUSE CVE-2026-13720

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

SUSE CVE-2026-81842

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

CLEANSTART-2026-KK56976 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

EUVD-2026-90429

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

PT-2026-104048

Name of the Vulnerable Software and Affected Versions Ragflow versions prior to 0.24.1 Description Improper access control exists in the update metadata setting function located in the api/apps/kb app.py file. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossin...

PT-2026-103902

Name of the Vulnerable Software and Affected Versions Fortra BoKS Manager affected versions not specified Description An authenticated user with permissions to add CRL URLs can trigger shell command substitution. This occurs when using the BCC, the WSI REST or SOAP API, or the cacrl command-line...

PT-2026-103969

🚨 CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, ...

PT-2026-103901

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks...