PT-2026-70152

Name of the Vulnerable Software and Affected Versions OpenShift Console affected versions not specified Description A Server-Side Request Forgery SSRF and supply chain flaw exists in the OpenShift Console Helm catalog proxy. A namespace tenant can create a ProjectHelmChartRepository using an...

CVE-2026-44762: Improper Restriction of Rendered UI Layers or Frames

SAP Data Services Management Console allows an overly permissive Content Security Policy CSP configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicio...

CVE-2026-66806

A flaw was found in console. When the HTTPSPROXY environment variable is not configured, the console component fails to verify Transport Layer Security TLS certificates for outbound connections. A network-positioned attacker Man-in-the-Middle can exploit this vulnerability to intercept the cluste...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2025-32736 PingFederate Administrative Console CSRF weaknesses

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2025-32736

PingFederate Administrative Console is affected by a CSRF vulnerability affecting versions before 13.1. An attacker could trigger unauthorized actions via specially crafted links while an admin has an active session. Underlying issue is CSRF in the Administrative Console; exploitation is indicate...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2025-32736 PingFederate Administrative Console CSRF weaknesses

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

Symlink Attack

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Symlink Attack via FilePath.untarFrom in core/src/main/java/hudson/FilePath.java. An authenticated attacker with job configuration privileges can exploit TAR extracti...

CVE-2026-19429 Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass and Blank-Name Check Bypass (Arbitrary File Read)

Jenkins FilePath.untarFrom does not validate symlink targets in extracted TAR archives, even in versions patched for CVE-2026-33001 and CVE-2026-70427. An authenticated attacker with job configuration privileges can include a malicious archive in a build step that creates workspace symlinks...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-64940

CVE-2026-64940 pertains to Tegalog -Fumy Otegaru Memo Logger- from Nishishi Factory. The issue arises from a permissive regular expression, enabling an attacker who can access the affected product to log in to the management console and perform operations available there. Connected advisories (NV...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

EUVD-2026-55081

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2025-32736: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

PT-2026-69989

Name of the Vulnerable Software and Affected Versions PingFederate versions prior to 13.1 Description Cross-Site Request Forgery CSRF weaknesses in the Administrative Console may allow actors to perform unauthorized actions. This occurs when administrators with active sessions are triggered to...

CVE-2026-64940: Permissive Regular Expression

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2025-6508

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...