CVE-2025-36298

IBM Sterling B2B Integrator and IBM Sterling File Gateway Ebics server components are vulnerable to cross-site scripting (CWE-79). Affected versions include B2Bi and File Gateway 6.1.2.0–6.1.2.7_2, 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, and 6.2.2.0–6.2.2.0_1. The vulnerability allows an authentica...

CVE-2025-36298 Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway

IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 Ebics server component is...

CVE-2026-22622

Summary: CVE-2026-22622 affects Eaton’s Tripp Lite series PADM firmware. An authenticated user can exploit improper input validation in a session management interface to elevate privileges, potentially gaining unrestricted device access. The CVSSv3.1 base score is 8.8 (HIGH) with network attack v...

CVE-2026-22622

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device...

CVE-2026-15252

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

EUVD-2026-50998

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

CVE-2026-15235 Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...

CVE-2026-15235

The MotoPress Hotel Booking WordPress plugin prior to version 6.0.4 is affected by an access-control issue in an AJAX action: it does not perform a capability check when returning a booking’s full customer details. Any authenticated user with a low-privileged role (Subscriber and above) can read ...

MongoDB 8.3.x < 8.3.7 Aggregation Framework Memory Exhaustion (SERVER-128584)

The version of MongoDB installed on the remote host is 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation...

CVE-2026-15077

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed b...

CVE-2026-15831

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during tok...

CVE-2026-12436

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2025-14562

CVE-2025-14562 affects GitLab CE/EE; versions 10.6–19.0.4, 19.1.x before 19.1.3, and 19.2.x before 19.2.1 are impacted. An authenticated user with developer permissions could commit changes to a project after removal due to improper authorization checks on merge request collaboration settings. Gi...

CVE-2026-6267 Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

CVE-2026-6267 Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

CVE-2026-12436

GitLab CE/EE is affected by CVE-2026-12436 in versions 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. The issue arises from improper validation of user-supplied attributes when processing pipeline schedule inputs, potentially allowing an authenticated user to modify another user’...

CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-13113 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race conditio...

EUVD-2026-50481

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race conditio...