CVE-2026-1242: Incorrect Authorization

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

UBUNTU-CVE-2026-63450

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverabl...

CVE-2026-76899

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...

CVE-2026-76899 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...

EUVD-2026-83373

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...

CVE-2026-76899 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...

CVE-2026-76899

CordysCRM (open-source AI-powered CRM with private deployment) contains an authenticated SQL injection in versions 1.7.0 through 1.7.4 (fixed in 1.7.4 ). The vulnerable endpoint is POST /account-pool/page , accessible to authenticated callers holding the MODULE_SETTING_UPDATE permission. The root...

CVE-2026-61795

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostnameregex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitte...

CVE-2026-61672 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbiddenlist.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list...

EUVD-2026-83055

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbiddenannotationsregex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating...

CVE-2026-1030

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data...

CVE-2026-84449 libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

CVE-2026-1030 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data...

CVE-2026-1030 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data...

EUVD-2026-83138

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data...

CVE-2026-1030

CVE-2026-1030 affects IBM Common Licensing (Agent 9.0, 9.0.0.1, 9.0.0.2; ART 9.0, 9.0.0.1, 9.0.0.2), which generates error messages containing sensitive information about its environment, users, or associated data (CWE-209). The vulnerability requires low privileges and no user interaction, with ...

CVE-2025-1350

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2025-1350 Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2025-1350 Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

EUVD-2025-210933

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...