CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

EUVD-2026-87131

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-33639

Versions of InvoicePlane prior to 1.7.2 are vulnerable to DDL injection due to a lack of strict integer validation in the Settings::index() function. The application interpolates the administrator-controlled tax_rate_decimal_places setting directly into an ALTER TABLE statement for ip_tax_rates. ...

CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

BIT-GITLAB-2026-8030 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

EUVD-2026-86539

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

PT-2026-98363

Name of the Vulnerable Software and Affected Versions OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin versions prior to 1.1.8 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticat...

CVE-2026-33639: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-97966: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: reset HTB scheduler topology before freeing queues HTB offload programs NIXAFTLxXTOPOLOGY on QoS-allocated scheduler queues via otx2qostxschqsetparenttopology, but teardown freed those queues without clearing...

CVE-2026-19775: Missing Authorization

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

PT-2026-98875

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to perform strict integer validation on the tax rate decimal places setting, which is controlled by the administrator. This value is interpolated into an ALTER TABLE statement...

firefox: thunderbird: Mitigation bypass in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Remote Settings Client component...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-79766

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

SUSE CVE-2026-88804

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18...

CVE-2026-79766 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-4806

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable in all versions up to and including 1.1.2 . The root cause is a missing capability check on the save_option() function, which allows unauthenticated attackers to perform unauthorized settings export or settings reset (de...

CVE-2026-4806 Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the saveoption function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in USB settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation through a crafted HTML page. Chromium security severity: Medium...