CVE-2026-66418

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

CVE-2026-14522 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

CVE-2026-14519

IBM App Connect Enterprise (versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27) is affected by CVE-2026-14519, a path traversal flaw that could allow a remote attacker to read arbitrary files. The issue is described as a path traversal vulnerability in the product’s file handling, with a base CVS...

CVE-2026-14519 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CVE-2026-14519 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

PT-2026-66598

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard version 3.0.0 Description A stored cross-site scripting issue exists where unauthenticated remote attackers can inject arbitrary HTML and script payloads. This occurs when a crafted username is submitted in a failed login PO...

PT-2026-65738

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcr admin page html function. This makes it possible for...

CVE-2026-14167

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization...

CVE-2026-14167

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization...

CVE-2026-14167: Incorrect Authorization

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization...

UBUNTU-CVE-2026-15811

A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after...

CVE-2026-58658 GPUStack Unauthenticated Information Disclosure via Worker Endpoints

GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port...

CVE-2026-58658

Summary. CVE-2026-58658 affects GPUStack up to version 2.2.1 and was fixed by commit 4e20551. An unauthenticated attacker can abuse unprotected /serveLogs and /debug endpoints on the worker port to disclose sensitive information and configure logs. Specifically, attackers can enumerate model inst...

PT-2026-57843

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a...

CVE-2026-57475

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access an...

EUVD-2026-42975

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access an...

EUVD-2026-41375

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized...

CVE-2026-8079

Progress Flowmon is affected in versions prior to 12.5.9 and 13.0.11, where an authenticated low-privileged user can craft a PDF-generation request that causes operations to run with another user’s privileges, potentially exposing sensitive data and enabling unintended configuration changes. The ...

CVE-2026-8079

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized...

CVE-2026-8079 Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized...