CVE-2026-67408: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/vhost/name reques...

EUVD-2026-87086

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

PT-2026-99070

Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A technician can manipulate the authtype value via the API to modify the authentication method of another user. In environments utilizing SSO logins or the lega...

Linux Distros Unpatched Vulnerability : CVE-2026-98156

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to...

PT-2026-98907

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.21 RabbitMQ versions 4.1.x prior to 4.1.14 RabbitMQ versions 4.2.x prior to 4.2.7 Description An administrator can cause a node crash via a single request by creating a user or importing definitions containi...

PT-2026-98848

The AIL Framework crawler task creation API api add crawler task contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compar...

PT-2026-98420

CISA added two critical flaws to the KEV catalog yesterday, confirming active exploitation in the wild. Both are being actively targeted. Technical Breakdown: - CVE-2026-5430 CVSS 9.8: Path traversal in WSO2 API Control Plane. Allows unauthenticated remote attackers to read arbitrary files or...

CVE-2026-97818: Incorrect Authorization

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php...

CVE-2026-6086: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-97879: Missing Authentication for Critical Function

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely...

CVE-2026-56728: Exposure of Sensitive Information to an Unauthorized Actor

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. T...

PT-2026-98903

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description A protected tag bypass exists when the rabbitmqmanagement plugin is...

CVE-2026-66073: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

PT-2026-99009

Parse Server versions = 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still returned i...

CVE-2026-51772: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-53627: Missing Authorization

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

PT-2026-98413

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/serial-number-types' endpoint, where...

CVE-2026-56725: Missing Authentication for Critical Function

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/importcheck blocks a Zammad request worker for roughly two minutes. The importcheck and importstatus actions are missing the setupdoneresponse guard...

PT-2026-98416

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/categories' endpoint, where malicious...