PT-2026-95296

Name of the Vulnerable Software and Affected Versions RESTEasy affected versions not specified Description A flaw exists in the CorsFilter component. When configured to allow all origins using the "" wildcard, the filter reflects the request's Origin header in the Access-Control-Allow-Origin...

CVE-2026-81505: Authorization Bypass Through User-Controlled Key

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...

CVE-2026-1031: Improper Neutralization of Input During Web Page Generation

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

PT-2026-95500

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key...

PT-2026-95585

Name of the Vulnerable Software and Affected Versions cockpit-machines affected versions not specified Description A flaw in the install machine.py script allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine VM credentials, such as...

PT-2026-95586

Name of the Vulnerable Software and Affected Versions cockpit-machines affected versions not specified Description A flaw in the cockpit-machines component allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords. This occurs because the component...

CVE-2026-92768: Invocation of Process Using Visible Sensitive Information

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password value...

CVE-2026-45143

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...

Security Bulletin: Vulnerable Version of Software in Use

Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of curl. Vulnerability Details CVEID:CVE-2026-1965 DESCRIPTION: libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features...

CVE-2026-45143 Chamilo LMS: Student-to-admin stored XSS in private messages via v-html

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

GHSA-5843-9MH5-HHGW Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h85j-hv3c-qfgq. This link is maintained to preserve external references. Original Description vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM i...

CVE-2026-81440

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-81440

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-81440

Dell OpenManage Server Administrator, versions prior to 11.1.0.3 , contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this flaw to gain Unauthorized access to the system. To remediate this issue, users are recommended t...

EUVD-2026-81459

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-85717: Exposure of Sensitive Information to an Unauthorized Actor

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

PT-2026-95104

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint...

CVE-2026-45143: Improper Neutralization of Input During Web Page Generation

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...