EUVD-2026-69557

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...

libssh: libssh: denial of service via oversized SFTP read length

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2026-84207

Heym before 0.0.98 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its WebSocket Send and WebSocket Trigger workflow nodes. The root cause is the failure to apply SSRF egress guards to these nodes, allowing authenticated users to craft workflow nodes with arbitrary URLs and h...

EUVD-2026-69295

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...

EUVD-2026-69292

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-84205 GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-79686

Dell PowerStore contains a Protection Mechanism Failure vulnerability that allows an authenticated user with limited privileges to bypass access restrictions and gain escalated privileges. The Dell-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicat...

CVE-2026-79684

Dell PowerStore contains a Protection Mechanism Failure vulnerability (CVE-2026-79684, CVSS 3.1 score 8.8 HIGH ). An authenticated user with limited privileges could bypass access restrictions to gain escalated privileges , with high impact on confidentiality, integrity, and availability over the...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-84196

Kyverno before 1.18.0 is affected by a server-side request forgery (SSRF) in the apiCall.service.url field. The root cause is variable substitution that allows authenticated users to inject user-controlled input, enabling arbitrary outbound HTTP requests to internal services, cloud metadata endpo...

Security Bulletin: IBM i is Affected By An Incorrect Authorization Vulnerability [CVE-2026-16941]

Summary IBM i is vulnerable to allowing a remote authenticated attacker to modify certain system messages CVE-2026-16941 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16941 DESCRIPTION: IBM i could allow a remote authenticated attacker to modify certain...

PT-2026-84388

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Deserialization of untrusted data in the machine learning component allows remote code execution through object injection. An attacker can use a specially crafted trained model artifact...

PT-2026-84427

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A privilege escalation issue exists in the web-based management interface. This flaw allows an authenticated user with low-privilege operator permissions to perform...

PT-2026-84425

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Authenticated remote attackers can perform SQL injection attacks against the API of the HPE Networking Fabric Composer. This flaw allows the attacker to retrieve and...

PT-2026-84426

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Command injection flaws in the web-based management interface allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlyin...

CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...

CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...

CVE-2026-61638

CVE-2026-61638 affects Wallos , an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6 , the endpoint POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from the request body with no SSRF validation , allowing PHPMailer to connec...