PT-2026-88269

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-85983: Improper Control of Generation of Code

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...

PT-2026-88268

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-86729: Improper Restriction of Excessive Authentication Attempts

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...

CVE-2026-68852: Use of Uninitialized Resource

Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally...

Release Information for Veeam Plug-In for Microsoft Azure 9.1

Release Information 13.9.1.407 2026-09-08 Resolved issues General Storage account credentials are stored in plain text on worker appliances. Configuration Backup Configuration backup for the managed backup appliance fails after upgrading Veeam Backup & Replication to version 13.1. Under certain...

Siemens Industrial Edge Management

SUMMARY Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products...

CVE-2026-86478

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...

CVE-2026-86478

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...

CVE-2026-86478

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...

EUVD-2026-72494

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...

CVE-2026-86478

JetBrains YouTrack is vulnerable to an improper authentication flaw in the YouTrack Helpdesk component prior to versions 2025.3.161254 and 2026.1.14042 . The vulnerability allows an unauthenticated attacker to perform account takeover by supplying a self-asserted email address, effectively bypass...

WordPress SureCart plugin < 4.6.3 - Subscriber+ Administrator Account Takeover vulnerability

Subscriber+ Administrator Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin SureCart versions 4.6.3...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier vulnerability

Unauthenticated Account Takeover via 'acfobjects' Object Identifier vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...

WordPress MemberDash plugin <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter vulnerability

Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter vulnerability discovered by Foxyyy in WordPress Plugin memberdash versions = 1.8.5...

WordPress Nokri - Job Board WordPress theme plugin <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover vulnerability

WordPress Nokri - Job Board WordPress theme plugin = 1.6.4 - Missing Authorization to Authenticated Subscriber + Privilege Escalation via Account Takeover vulnerability discovered by Tonn in WordPress Theme Nokri versions = 1.6.4...

MAL-2026-16022 Malicious code in base-account-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae6343291a1e909323f40cb39c63de633e733d3a7ca24827d35ff2d960f9e6a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in base-account-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae6343291a1e909323f40cb39c63de633e733d3a7ca24827d35ff2d960f9e6a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-86478: Authentication Bypass by Spoofing

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...

PT-2026-86850

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...