PT-2026-88455

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

EUVD-2026-72848

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

CVE-2026-85982: Improper Neutralization of Input During Web Page Generation

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...

PT-2026-87170

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator ...

CVE-2026-79576

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

CVE-2026-79576

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

CVE-2026-79588

U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP...

CVE-2026-86735: Server-Side Request Forgery (SSRF)

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

CVE-2026-86500

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

EUVD-2026-72516

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

CVE-2026-86500

In JetBrains YouTrack versions prior to 2026.1.14047 , a missing escalation check allowed a user with project update permissions to grant themselves Project Admin rights, effectively elevating their access beyond the intended permission level. The underlying cause is the absence of a proper check...

CVE-2026-86500

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

CVE-2026-86500

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

CVE-2026-12853

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

Exploit for Improper Authentication in Jfrog Artifactory

CVE-2026-82329-JFrog-Artifactory- CVE-2026-82329 — JFrog Arti...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-76578

FreeIPA is affected by a critical flaw (CVSS 9.8 ) in its self-managed OTP token ACI , which does not require authentication and fails to restrict which attributes may be added alongside a token entry. Combined with a related flaw in the underlying directory server's ACI evaluation (tracked separ...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier vulnerability

Unauthenticated Account Takeover via 'acfobjects' Object Identifier vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...

PT-2026-86917

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...