PT-2026-95348

Name of the Vulnerable Software and Affected Versions T-Systems TAO 2.0 affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in the profile management functionality. An authenticated user can inject malicious HTML or JavaScript into personal data fields. This...

PT-2026-95550

Name of the Vulnerable Software and Affected Versions Kyoo versions prior to 5.1.0 Description An unauthenticated attacker can initiate an OpenID Connect OIDC login flow using a controlled redirectUrl. The system stores this URL within the login state, and the endpoint '/auth/oidc/logged/provider...

PT-2026-95581

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.68 Description The password authentication flow for protected shared notes fails to rotate the session identifier after successful authentication, leading to session fixation. This occurs when an attacker obtai...

Open WebUI Backend File Data Compromise

The vulnerability in the web interface based on artificial intelligence, namely backend/openwebui/routers/auths.py, backend/openwebui/utils/oauth.py, and backend/openwebui/socket/main.py, is related to incorrect session expiration times. Exploiting this vulnerability could allow a malicious actor...

PT-2026-95556

Name of the Vulnerable Software and Affected Versions versions prior to 0.9.0 Description The intra-handshake attested TLS aTLS Intel TDX verification path fails to copy the expected current-session freshness value into the TDX quote-body policy before quote validation. Consequently, structurally...

CVE-2026-75878: Improper Authentication

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

Linux Distros Unpatched Vulnerability : CVE-2026-90154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the...

EulerOS Virtualization 2.11.1 : httpd (EulerOS-SA-2026-3422)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

CVE-2026-86688

Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existi...

CVE-2026-76949

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-54644

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

CVE-2026-54645

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-53555

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content...

CVE-2026-54645

CubeCart is an e-commerce platform where a stored XSS vulnerability exists in the product management panel prior to version 6.7.5. In admin/sources/products.index.inc.php (lines 55–59), the application bypasses its global sanitizer by reading description, description_short, and spec_copy fields d...

EUVD-2026-82532

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-54644 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

CVE-2026-54644 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

EUVD-2026-82529

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

CVE-2026-54644

CubeCart (ecommerce platform) prior to 6.7.5 is vulnerable to Cross-Site Scripting (XSS) via the _errorMessage method in classes/gui.class.php. The method uses strip_tags($message, ''), which permits anchor tags but retains unsafe href attributes and onclick event handlers. Attacker-controlled se...