CVE-2026-3199

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data involving task management that allows authenticated users with task creation permissions to execute arbitrary code by injecting malicious properties into a serialized object. A user can bypass...

CVE-2026-3199

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control...

CVE-2026-3199

CVE-2026-3199 is an authenticated remote code execution flaw in Sonatype Nexus Repository’s task management component, affecting versions 3.22.1 through 3.90.2. An attacker with task creation permissions can bypass nexus.scripts.allowCreation and execute arbitrary code. The connected CVE records ...

CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control...

CVE-2026-35479

creationtimestamp| type| source ---|---|--- 2026-04-08 22:11:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizcrhd7sc2z...

CVE-2026-35446

creationtimestamp| type| source ---|---|--- 2026-04-08 21:33:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizanh3xag2i 2026-04-09 01:26:43+00:00| published-proof-of-concept| Telegram/LyxiOFuM6k6JRrVhGkcWrU8R1Vj8dluNTy4xGDA54CBUTMw 2026-04-09 07:06:03+00:00| seen|...

CVE-2026-32586

creationtimestamp| type| source ---|---|--- 2026-04-08 20:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miz53zmpwx2u...

CVE-2026-40088

creationtimestamp| type| source ---|---|--- 2026-04-08 20:29:05+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2763-cj5r-c79m 2026-04-09 20:52:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3osk6xzy22 2026-04-09...

CVE-2026-5847

creationtimestamp| type| source ---|---|--- 2026-04-08 20:16:06+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5847...

CVE-2025-52222

creationtimestamp| type| source ---|---|--- 2026-04-08 19:43:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116370795058822997...

CVE-2024-3018

creationtimestamp| type| source ---|---|--- 2026-04-08 19:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3miz2cnxw7i2r...

CVE-2025-50669

creationtimestamp| type| source ---|---|--- 2026-04-08 19:30:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116370742055082948...

CVE-2026-34722

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4...

CVE-2026-35478 InvenTree has Arbitrary API Token Creation

InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST...

CVE-2026-35478 InvenTree has Arbitrary API Token Creation

InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST...

CVE-2026-35478 InvenTree has Arbitrary API Token Creation

InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST...

CVE-2026-35478

CVE-2026-35478 affects InvenTree Open Source Inventory Management System (versions 0.16.0 through before 1.2.7). The issue allows any authenticated InvenTree user to create a valid API token for any other user (including admins) by supplying the target user’s ID in the POST /api/user/tokens/ requ...

CVE-2026-56078

creationtimestamp| type| source ---|---|--- 2026-04-08 19:21:32+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-766v-q9x3-g744 2026-06-19 01:29:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mom6w2ozwi2r...

Cross-site Scripting (XSS)

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Cross-site Scripting XSS in the content field during page creation and update operations, where user-supplied HTML is stored without proper sanitization and rendered...