GHSA-8HW4-7QJR-3WXG Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...

CVE-2026-76635

baserCMS before 5.3.0 is vulnerable in BcDatabaseService.php, where authenticated administrators can inject attacker-controlled table names and configuration values directly into SQL statements across sequence-update, CSV-export, and table-management operations. This chains with a backup-restore ...

PT-2026-80253

Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...

EUVD-2026-63081

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

CVE-2026-23938

A flaw was found in Zabbix. An authenticated administrator can exploit this vulnerability by creating specially crafted JavaScript scripts within preprocessing or script items. This can lead to a denial of service DoS by crashing the Zabbix server or proxy. Mitigation Restrict administrative acce...

GHSA-C9FV-CGMM-2WG7 LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands. Details The vulnerability is caused by an unsafe exec...

EUVD-2026-60468

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

CVE-2026-44845

JumpServer versions prior to 4.10.17 allow an authenticated administrator with Applet Host permissions to inject Jinja2 expressions into the IP/Host or Core Service Address fields, causing Ansible to evaluate them during deployment and execute arbitrary commands on the control node. The fix is in...

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

CVE-2026-64657

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

GHSA-6X2C-PHFF-WX57 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Vulnerability Information - Product: new-api - Affected versions: versions before v1.0.0-rc.7 that serialize User.AccessToken as accesstoken; the issue was confirmed in v0.12.14 - Patched version: v1.0.0-rc.7 - Fixed commit: 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 - Type: Information Disclosure ...

PT-2026-76668

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-19631

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...

PT-2026-72056

Name of the Vulnerable Software and Affected Versions Tenable Security Center affected versions not specified Description A command injection flaw allows an authenticated administrator to execute arbitrary commands on the underlying operating system. This occurs when the administrator modifies...

CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73660

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

EUVD-2026-58483

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

CVE-2026-18741

Summary: CVE-2026-18741 affects Worksuite SaaS prior to v6.0.14 and is a stored cross-site scripting vulnerability in the Asset Management module. The flaw allows authenticated administrators to inject arbitrary JavaScript by submitting payloads into the Location or Description fields during asse...

EUVD-2026-58130

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

EUVD-2026-58106

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...