CVE-2026-62142

The Melapress WP 2FA plugin (wp-2fa) for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions 4.1.0 and below . This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The documentation does not specify the exact component...

EUVD-2026-94932

Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...

CVE-2026-103647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message from 6.3.2 or an OpenPGP message...

CVE-2026-103647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message from 6.3.2 or an OpenPGP message...

CVE-2026-103647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message from 6.3.2 or an OpenPGP message...

CVE-2026-66082

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an authorization bypass (CWE-863) that allows authenticated users to perform unauthorized operations on workflow schedules, definitions, and task instances in other projects. The root cause is that affected endpoints verify permissio...

CVE-2026-66082 Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...

CVE-2026-107449

A flaw was found in Heimdall. This vulnerability allows an unauthenticated remote attacker to cause information disclosure via server-side request forgery SSRF. The application fails to enforce IP address restrictions when sending outbound requests for enhanced application testing and live...

WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Theme Educavo versions = 3.4.2...

CVE-2026-87687

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabri...

CVE-2026-107445 Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

EUVD-2026-94693

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-107445

A flaw in Katello exists where the Flatpak Remote Repositories API fails to properly enforce authorization when accessing repositories by identifier. This allows an authenticated user with permissions in one organization to potentially access repository information belonging to a different organi...

CVE-2026-107445 Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-87687

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 . An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabr...

CVE-2026-87687

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabri...

CVE-2026-87687

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabri...

EUVD-2026-94687

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabri...

Linux Distros Unpatched Vulnerability : CVE-2026-107282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1,...

CVE-2026-107800: Improper Neutralization of Input During Web Page Generation

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which...