CVE-2026-103291: Server-Side Request Forgery (SSRF)

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

CVE-2026-102106

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-102106 Kiteworks Email Protection Gateway improper authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-100276

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...

CVE-2026-100258

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings...

EUVD-2026-90002

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings...

CVE-2026-94178

Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...

CVE-2026-62081

Contributor Insecure Direct Object References IDOR in Flexible PDF Coupons = 1.14.11 versions...

CVE-2026-94178 WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...

CVE-2026-94178 WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...

CVE-2026-94178

The WordPress Import and export users and customers plugin, versions

EUVD-2026-89820

Contributor Insecure Direct Object References IDOR in Flexible PDF Coupons = 1.14.11 versions...

CVE-2026-102585

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

CVE-2026-102106: Improper Authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

PT-2026-103305

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Missing authorization allows users with read-only permissions to access and read project settings. Recommendations Update to version 2026.2.18991...

CVE-2026-100276: Incorrect Authorization

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...

CVE-2026-94178: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...

PT-2026-103175

Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...

EUVD-2026-89085

Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...