PT-2026-79576

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

PT-2026-79585

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An issue exists where the 'onUpdateComment' endpoint does not perform necessary access checks, allowing unauthenticated users to modify any comment. Recommendations Update to version 4.7.2 or later...

EUVD-2026-63831

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

CVE-2026-66797

Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to an improper access control flaw in the annotation functionality . The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is provided but fail to honor the resul...

CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

CVE-2026-66797

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

Denial Of Service (DoS)

sqlparse is vulnerable to Denial of Service DoS. The vulnerability is due to repeated rescanning of comment-only SQL statements before the grouping limit is enforced, which allows an attacker to provide crafted input that causes quadratic CPU consumption and degrades application performance...

PT-2026-79332

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

Python Library sqlparse < 0.6.0 Multiple Vulnerabilities

The version of the sqlparse Python library installed on the remote host is prior to 0.6.0. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists in sqlparse due to the regular expressions used by the lexer to match dollar-quoted strings and multiline...

EUVD-2026-63579

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861

In Appwrite templates' github-issue-bot, verifyWebhook uses an inverted condition (typeof signature !== 'string' || (await verify(...))) that short-circuits to success when the X-Hub-Signature-256 header is absent, skipping HMAC verification. Unauthenticated callers can then post arbitrary commen...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...

CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

WordPress Sunshine Photo Cart plugin < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure vulnerability

Unauthenticated Private Gallery Comment Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.6.12...

PT-2026-79116

Name of the Vulnerable Software and Affected Versions appwrite/templates affected versions not specified Description The github-issue-bot templates contain a logic error in the GitHub webhook signature verification process. The verifyWebhook function in node/github-issue-bot/src/github.js and...

CVE-2026-76610: Cross-Site Request Forgery (CSRF)

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

PT-2026-78913

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

Missing Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the API endpoints for comments and attachments. An attacker can access restricted comment text, commenter email addresses, and...