CVE-2026-88756: Improper Neutralization of Special Elements used in an SQL Command

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-88756

Pagekit CMS versions

CVE-2026-94152: Authorization Bypass Through User-Controlled Key

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-94535: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...

CVE-2026-77518: Missing Authorization

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

PT-2026-96055

Name of the Vulnerable Software and Affected Versions Omega Solution FBP Fulfillment by People 2025 Description An authorization bypass exists within the User Profile API component in the /user/ file. Remote exploitation is possible by manipulating the ID argument, allowing an attacker to bypass...

PT-2026-96162

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.0 Description An unauthenticated remote attacker can trigger a global login lockdown by sending POST requests to the '/api/user/login' endpoint using 257 distinct nonexistent usernames. This occurs because the...

CVE-2026-61743: Reliance on Reverse DNS Resolution for a Security-Critical Action

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...

PT-2026-96205

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description The software fails to redact password hashes in the '/user/info' endpoint. This allows authenticated users to retrieve unsalted MD5 password digests for any user by supplying specific user IDs. These...

PT-2026-96102

Name of the Vulnerable Software and Affected Versions Beszel versions prior to 0.19.0 Description An insecure direct object reference occurs in the 'POST' and 'DELETE' '/api/beszel/user-alerts' endpoints. This allows authenticated users to create or delete alerts for systems they are not authoriz...

CVE-2026-83621: Missing Authorization

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

PT-2026-96153

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260718 Description Authenticated non-administrator users can list and download system-configuration backups due to a missing administrator check in the endpoints 'scripts/lua/rest/v2/get/system/configurations/list...

PT-2026-96204

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An authorization bypass exists in the 'POST /user/resetPwd' endpoint. This flaw allows authenticated users to reset the password of any other user, including administrators, by submitting a request with...

CVE-2026-94033

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

CVE-2026-94033

A cross-site scripting (XSS) vulnerability affects the User Management component of SourceCodester Drug Recommendation System 1.0 , specifically in the file /drug_recommender/Admin/add_user. Manipulation of the txtname, txtemail, or txtpassword arguments enables the XSS payload. The attack is rem...

EUVD-2026-83749

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

CVE-2026-94033 SourceCodester Drug Recommendation System User Management add_user cross site scripting

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

CVE-2026-94033 SourceCodester Drug Recommendation System User Management add_user cross site scripting

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

OESA-2026-3978 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: When an /etc/fstab entry is configured with the user or users option, mount8 validates the target path before performing the mount syscall, creating a...

OESA-2026-3882 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. During storage volume clone or convert operations,...