CVE-2026-109695: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1...

CVE-2026-110361: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...

CVE-2026-108116: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...

CVE-2026-24718: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...

CVE-2025-66272: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...

CVE-2026-76660: Improper Input Validation

A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data...

CVE-2026-39993: Relative Path Traversal

A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:...

PT-2026-115292

Name of the Vulnerable Software and Affected Versions Likeshop versions prior to 3.5.2 Description An insecure direct object reference issue exists in AfterSale.php and AfterSaleLogic.php. Authenticated users with self-registered accounts can access after-sale records of other customers by...

CVE-2026-106151: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg- attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the...

CVE-2026-110812: Deserialization of Untrusted Data

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...

CVE-2026-111350: Missing Authorization

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group...

PT-2026-114443

Name of the Vulnerable Software and Affected Versions Wheels CLI versions prior to 4.1.1 Description The software fails to verify that the local development server responding to HTTP requests is associated with the current project. A malicious process listening on a targeted local port can...

CVE-2026-101337

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...

CVE-2026-44038

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

Linux Distros Unpatched Vulnerability : CVE-2026-93484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper...

CVE-2026-9703: Improper Access Control

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

PT-2026-115131

Name of the Vulnerable Software and Affected Versions CFITSIO versions prior to 4.7.1 Description A heap-based out-of-bounds read exists in the HCOMPRESS tile decoder. An attacker can provide a specially crafted FITS file with ZCMPTYPE set to HCOMPRESS 1 and oversized tile geometry to read past t...

CVE-2026-111313: Server-Side Request Forgery (SSRF)

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Multiple Atlassian products Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye contain a files or directories accessible to external parties vulnerability which could allow an...