CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

SUSE CVE-2026-13719

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

SUSE CVE-2026-13720

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

SUSE CVE-2026-81842

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

CLEANSTART-2026-KK56976 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

EUVD-2026-90429

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-103491: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

CVE-2026-103534: Improper Access Control

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...

PT-2026-103693

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU WordPress plugin versions prior to 6.0.8 Featured Image from URL FIFU Premium WordPress plugin versions prior to 8.2.8 Description Cross-Site Request Forgery CSRF occurs because the software fails to correctly...

PT-2026-103710

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...

PT-2026-103741

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15 Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. Attackers can inject arbitrar...

PT-2026-103751

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

PT-2026-103915

Name of the Vulnerable Software and Affected Versions rubygem-foreman remote execution affected versions not specified Description A command injection flaw exists in the Red Hat Satellite API endpoint '/api/v2/job invocations'. The issue occurs when a job template has the effective user property...

PT-2026-103899

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

PT-2026-105126

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

PT-2026-105169

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp uri:remove credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GE...

PT-2026-105578

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedge...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51896: Improper Access Control

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...