CVE-2026-13227 ERPNext v16.25.0 - Improper authorization in Prospect opportunities API

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...

EUVD-2026-52898

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

CVE-2026-18812

The CVE-2026-18812 entry concerns H3C NX15 V100R017. The affected component is esps.ipv6.wan in the /api/esps path. The root cause is manipulation of the argument workMode, enabling command injection. Exploitation is possible remotely, with a published exploit. The CVE documents do not provide re...

CVE-2026-14643 vulnerabilities

Vulnerabilities for packages: langfuse-fips, pelias-api, renovate, vitess, code-server...

GHSA-JR45-8VMC-QM54 vulnerabilities

Vulnerabilities for packages: langfuse-fips, pelias-api, renovate, vitess, code-server...

CVE-2026-69153 vulnerabilities

Vulnerabilities for packages: semaphore, authentik-fips, keep-fips, langfuse-fips, pelias-api, authentik, nextcloud-server, renovate, vitess, keep, kubeflow-pipelines...

GHSA-FXQJ-RQCC-2CMP vulnerabilities

Vulnerabilities for packages: semaphore, authentik-fips, keep-fips, langfuse-fips, pelias-api, authentik, nextcloud-server, renovate, vitess, keep, kubeflow-pipelines...

GHSA-RGW5-RVV9-X895 vulnerabilities

Vulnerabilities for packages: pelias-api, pulumi, opensearch-dashboards-fips, unleash-proxy, gitlab-rails-ce-fips, gemini-cli, serve, redisinsight, unleash, npm, dotstatsuite-supercore, langfuse, rancher-api-ui, langfuse-fips, argo-workflows, nextcloud-server, authentik-fips, authentik,...

CVE-2026-69152 vulnerabilities

Vulnerabilities for packages: pelias-api, pulumi, opensearch-dashboards-fips, unleash-proxy, gitlab-rails-ce-fips, gemini-cli, serve, redisinsight, unleash, npm, dotstatsuite-supercore, langfuse, rancher-api-ui, langfuse-fips, argo-workflows, nextcloud-server, authentik-fips, authentik,...

GHSA-RGW5-RVV9-X895 vulnerabilities

Vulnerabilities for packages: pulumi, npm, serve, rancher-api-ui, argo-workflows...

CVE-2026-70483

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

EUVD-2026-52896

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The...

EUVD-2026-52891

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

CVE-2026-70471

CVE-2026-70471 – Flowise RBAC bypass : Prior to Flowise 3.1.3, unauthorized users (including keys) could access workspace-scoped variables via /api/v1/node-custom-function because $vars were injected into the code sandbox without requiring variables:view, bypassing the Variables API. Variables fo...

CVE-2026-69256

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

CVE-2026-63456

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

CVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

CVE-2026-69252

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

Important: Red Hat Security Advisory: Satellite 6.18.8 Async Update

A new release is now available for Red Hat Satellite 6.18 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...