CVE-2026-100673: Improper Neutralization of Input During Web Page Generation

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags' ' call that PHP's striptags bypasses...

PT-2026-99254

Name of the Vulnerable Software and Affected Versions Request a Quote for WooCommerce versions prior to 2.9.3 Description An arbitrary file upload issue exists in the afrfq submit quote via popup function. The popup upload handler fails to validate file extensions and MIME types, using the raw...

PT-2026-99294

🚨 CVE-2026-100623 Capgo capgo.app exposes the legacy membership table public.org users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization...

PT-2026-99300

Name of the Vulnerable Software and Affected Versions Capgo capgo.app backend versions prior to 12.127.5 Description An authorization flaw exists in the 'PATCH /private/role bindings/:binding id' endpoint. The handler verifies that the priority rank of a newly assigned role does not exceed the...

CVE-2026-100608: Missing Authorization

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...

PT-2026-99344

Name of the Vulnerable Software and Affected Versions Grav Data Manager versions 1.0.1 through 1.4.4 Description Stored data entries in the item-detail view admin/templates/partials/item.html.twig are rendered without proper escaping due to the use of Twig's raw filter. In certain instances, a...

PT-2026-99283

Name of the Vulnerable Software and Affected Versions Capgo capgo.app versions prior to 12.261.0 Description An incomplete access-control fix in the public.sso providers table allows a user with org admin permissions and the org.update settings permission to perform vertical privilege escalation...

CVE-2026-100706: Unintended Proxy or Intermediary

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100686: Improper Privilege Management

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant...

PT-2026-99377

Name of the Vulnerable Software and Affected Versions kyverno versions prior to 1.19.1 Description Insufficient validation of URL-encoded path segments in the Policy apiCall urlPath allows namespace tenants to bypass the per-namespace clamp. This enables the creation of objects in other namespace...

CVE-2026-100501

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100372

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

CVE-2026-100372

ClipBucket v5 versions prior to 5.5.3-#197 are vulnerable to a path traversal vulnerability within the admin template editor. Authenticated users with manage_template_access permissions can exploit the folder parameter by providing directory traversal sequences to move outside the layout director...

EUVD-2026-87315

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

CVE-2026-63216

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An...

CVE-2026-63205

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies th...

CVE-2026-100303

TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users...

CVE-2026-100303

The TDuck survey form (versions through 6.0 ) is vulnerable to a broken access control issue due to missing authorization checks on the FormThemeController write endpoints. This allows authenticated non-admin users to perform unauthorized actions, such as adding, modifying, or deleting global for...