CVE-2026-94588: Improper Neutralization of Argument Delimiters in a Command

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in...

CVE-2026-46649: Improper Restriction of Excessive Authentication Attempts

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...

CVE-2026-63342: Incorrect Authorization

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-52740: Incorrect Authorization

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

CVE-2026-59814: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

PT-2026-96279

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.7 Description An issue exists where the 'GET /shares/:id?resource id=' endpoint serves resources with an attacker-controlled mime value and omits the Content-Disposition header when the resource title is...

CVE-2026-55179: Authorization Bypass Through User-Controlled Key

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

PT-2026-95783

Name of the Vulnerable Software and Affected Versions Wow Elements Addons for Elementor versions prior to 1.11.3 Description This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated...

PT-2026-95869

Name of the Vulnerable Software and Affected Versions grimmory-tools grimmory versions 3.3.3 and earlier grimmory-tools grimmory versions 3.4.1 and earlier Description An incorrect authorization issue exists in the Settings API Endpoint. A remote attacker can manipulate the...

CVE-2026-76579: Improper Neutralization of Input During Web Page Generation

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

PT-2026-95900

Name of the Vulnerable Software and Affected Versions Comfast CF-N1-S version 2.6.0.1 Description The Web Management Interface contains a stack-based buffer overflow that can be triggered remotely. The issue exists within the get css path from uri function located in the /cgi-bin/mbox-config...

PT-2026-95737

Name of the Vulnerable Software and Affected Versions Divi Essential versions prior to 5.8.2 Description The Divi Essential plugin for WordPress allows authenticated attackers with Subscriber-level access and above to expose sensitive information. The issue exists within the dnxte get database...

CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

DEBIAN-CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

UBUNTU-CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

EUVD-2026-83273

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

CVE-2026-93852

OpenStack Blazar before 17.0.1 has a broken authorization flaw in the V2 lease listing endpoint (GET /v2/leases). The endpoint returns leases for every project without enforcing project scoping or an administrator-only policy, allowing any authenticated user with REST API access to enumerate leas...