SUSE CVE-2026-13720

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

SUSE CVE-2026-81842

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

CLEANSTART-2026-KK56976 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

EUVD-2026-90429

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-51896

The software infiniflow ragflow version 0.25.3 is affected by a vulnerability involving improper access control in the resume function located within the api/apps/connector_app.py endpoint. This security flaw enables an attacker to perform unauthorized cross-session or privilege-crossing operatio...

PT-2026-104043

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.9.4 Description An authenticated attacker can execute arbitrary Python code on the server via a code injection flaw. The issue exists because a public-facing route accepts raw Python source and forwards...

PT-2026-103807

Name of the Vulnerable Software and Affected Versions Ghost versions 5.42.2 through 6.57.0 Description An information disclosure issue exists in the Admin API bulk post and page edit and delete endpoints. These endpoints allow filters on restricted fields, such as authors.password, due to an...

CVE-2026-51895

Ragflow versions 0.24.0 and prior are affected by an improper access control vulnerability within the update_metadata_setting function located in api/apps/kb_app.py. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossing operations, depending on the specific expo...

PT-2026-105837

Summary The OAuth token fallback file storage in OAuthConfig. save tokens to file creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions typically 0644 on Linux, world-readable. Any local user on a shared system can read these files to obta...

PT-2026-105578

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedge...

PT-2026-103902

Name of the Vulnerable Software and Affected Versions Fortra BoKS Manager affected versions not specified Description An authenticated user with permissions to add CRL URLs can trigger shell command substitution. This occurs when using the BCC, the WSI REST or SOAP API, or the cacrl command-line...

CVE-2026-103491: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

CVE-2026-104059: Cross-Site Request Forgery (CSRF)

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-51888: Improper Limitation of a Pathname to a Restricted Directory

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-104051: Insufficiently Protected Credentials

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

PT-2026-103981

Name of the Vulnerable Software and Affected Versions Joyland AI affected versions not specified Description The application contains hard-coded credentials for the GeTui push notification service. This allows an attacker to access the GeTui REST API and send push notifications with arbitrary...

CVE-2026-102666: Use of Hard-coded Credentials

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once...

CVE-2026-101147: Cross-Site Request Forgery (CSRF)

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-82825: Missing Authentication for Critical Function

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...

CVE-2026-103281: Insertion of Sensitive Information Into Sent Data

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...