EUVD-2026-71269

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

CVE-2026-78658

IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy contain an information disclosure vulnerability (CWE-212) in the redaction engine. When a deployment's secure property begins with certain non-ASCII characters , subsequent ASCII secure values embedded inside unsecure properties may fail to be mask...

CVE-2026-85700 Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

EUVD-2026-71149

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

EUVD-2026-71114

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85618 ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

CVE-2026-74237

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...

CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

EUVD-2026-71027

Grav before 2.0.19 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 is affected by a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health. These endpoints enforce only authentication but omit permission checks, allowing any authenticated user—regardless of privilege level—to read site-w...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85540

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-75165

An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods ugw-ping, ugw-traceroute that are not exposed in the web UI, allowing attackers to obtain sensitive...

CVE-2026-85700: Insufficiently Protected Credentials

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

EUVD-2026-71449

An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods ugw-ping, ugw-traceroute that are not exposed in the web UI, allowing attackers to obtain sensitive...

PT-2026-85596

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an formation disclosure vulnerability when processing...