EUVD-2026-62403

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76225

ArcadeDB before 26.8.1 has a server-side request forgery flaw in its OpenCypher LOAD CSV implementation, which does not validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the server fetch and retu...

EUVD-2026-62465

ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...

EUVD-2026-62369

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-18371

An authenticated attacker in M-Files Web before version 26.8.16330.2 can inject HTML to alter UI contents shown to other users, enabling potential phishing or content spoofing. CVSS 4.0 rates it MEDIUM (5.1) with low privileges required and passive user interaction. No exploitation evidence is re...

CVE-2026-55984

A flaw was found in Gitea. An authenticated attacker could exploit a null pointer dereference within the AddTime API. This can lead to a denial of service DoS, making the application unavailable to legitimate users...

PT-2026-78493

A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

PT-2026-78256

Name of the Vulnerable Software and Affected Versions Speed Optimizer versions prior to 7.8.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via image tag...

PT-2026-78325

Name of the Vulnerable Software and Affected Versions M-Files Web versions prior to 26.8.16330.2 Description An authenticated attacker can perform HTML injection to modify the web user interface contents displayed to other users. Recommendations Update to version 26.8.16330.2...

PT-2026-78522

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

PT-2026-78407

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

CVE-2026-53958 4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id...

EUVD-2025-210739

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting...

CVE-2026-71880

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

EUVD-2026-61077

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...

CVE-2026-74046 Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...

CVE-2026-74046

Wazuh 4.4.0 through 4.14.6 is affected by a denial-of-service flaw in the fdecompress_files() function of cluster.py. The function decompresses synchronization archives without enforcing any decompressed size limit, so an attacker holding a valid cluster Fernet key can upload a small zip-bomb arc...

EUVD-2026-61075

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

CVE-2026-23938

Zabbix server/proxy is affected: an authenticated administrator can create specifically crafted JavaScript scripts in preprocessing/script items, causing a crash and denial of service . CVSS 4.0 rates this LOW (2.1) due to high privileges required and availability-only impact. Exploitation detail...

PT-2026-77337

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...