Astra Linux – Vulnerability in Intel Microcode

Observable timing discrepancies in some Intel processors may allow an authenticated user to potentially enable information disclosure through local access...

WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Import and export users and customers versions = 2.5.5...

CVE-2026-104808 Mitel MiVoice Office 400 stored Cross-Site Scripting

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening...

CVE-2025-32462

CVE-2025-32462 – سكريبت إثبات المفهوم لـ sudo هذا سكريبت للكشف عن تصعيد الامتيازات CVE‑2025‑32462 ، يوفر وضعين: الكشف المباشر عن sudo والكشف عن مرور المستخدم غير المميز. هيكل الملفات الملف| الوصف ---|--- poc.sh| ملف التحقق من الثغرة لـ CVE-2025-32462 يدعم bash، dash version.txt| ملف يستخدم لأداة...

Vulnerability of endpoints/api/restore and/api/users/admin/init of the Kubernetes management platform, allowing attackers to escalate their privileges

The vulnerability of the endpoints /api/restore and /api/users/admin/init of the Kubernetes management platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain increased privileges remotely...

PT-2026-106086

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...

CVE-2026-105682: Server-Side Request Forgery (SSRF)

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0...

CVE-2026-105683: Path Traversal: '.../...//'

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

PT-2026-104773

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening...

PT-2026-106205

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.0 Description An input validation issue in this Node.js content management system may allow staff users to access local files located outside the intended data storage directories on the server. Recommendatio...

PT-2026-106201

Name of the Vulnerable Software and Affected Versions Ghost versions 1.18.0 through 6.26.0 Description A Server-Side Request Forgery SSRF issue exists in the webhooks feature. This allows staff users to probe internal hosts from the Ghost server. SSRF is a flaw that allows an attacker to induce t...

PT-2026-106186

Name of the Vulnerable Software and Affected Versions Ghost versions 0.7.2 through 6.63.x Description Staff-level users can determine the relative ordering of hashed passwords belonging to other staff users. This issue does not directly disclose the password hashes or provide a practical method f...

CVE-2026-104893: Allocation of Resources Without Limits or Throttling

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-105639: Exposure of Sensitive Information to an Unauthorized Actor

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...

PT-2026-106019

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description An authenticated user can retrieve API-token records via the 'GET /api/users/api-tokens/' endpoint. Additionally, the 'PATCH /api/users/api-tokens/token id/' endpoint allows a user to modify the allowe...

CVE-2026-105649: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

CVE-2025-65950

CVE-2025-65950: WBCE CMS معرّض لحقن SQL أعمى قائم على الوقت عبر معامل groups نظرة عامة الحقل| التفاصيل ---|--- CVE ID| CVE-2025-65950 الخطورة| حرجة التنبيه الأمني| عرض التنبيه اكتُشف بواسطة| Lukasz Rybak المنتجات المتأثرة WBCE/WBCECMS التفاصيل الملخص تسمح ثغرة حرجة في حقن SQL في وحدة إدارة...

Compromised-Org-Chart-Generator

समझौता प्रभावित संगठन चार्ट जनरेटर अवलोकन Active Directory का उपयोग संगठन द्वारा पहचान प्रदाता के रूप में किया जाता है। इसमें सभी कर्मचारियों की जानकारी शामिल होती है, जिसमें उनके नाम, नौकरी के शीर्षक, विभाग और उनके प्रबंधक शामिल हैं। पासवर्ड ऑडिट कमजोरियों और जोखिमों की खोज करने में मदद कर सकते...

CVE-2026-105206

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105206

ZITADEL versions 3.0.0 through 3.4.15 and 4.x before 4.17.3 are vulnerable to an incorrect authorization flaw in the User Service API . The vulnerability exists because the system verifies the user.read permission against the caller's organization rather than the organization that owns the target...