CVE-2026-93975: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...

PT-2026-95954

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description A SQL injection flaw exists in the /Admin/edit symptom.php endpoint. This issue occurs when the ID argument is manipulated, allowing a remote attacker to execute arbitrary SQL...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of the data-subtab attribute in elements with the smw-subtab class. An attacker can inject arbitrary HTML and execute JavaScript by crafting malicious wikitext that is parsed and inserted...

EUVD-2026-82766

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of invalid UTF-8 bytes in the XSS detection function, which allows an authenticated attacker with page-edit permissions to bypass the XSS safety check, store malicious JavaScript, and execute it in a...

WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen

Description WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access...

EUVD-2026-60591

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits errorlog, giving arbitrary file write...

EUVD-2026-65220

Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...

CVE-2026-55062

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

CVE-2026-55061

uniget CLI (a universal installer and updater for container tools) contains an argument injection vulnerability in cmd/uniget/hooks.go (line 199). The hooks edit command parses the UNIGET_EDITOR or EDITOR environment variable using strings.Split(editor, " "), passing every space-delimited suffix ...

EUVD-2026-82370

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

CVE-2026-55062 uniget: Path Traversal in Hook Files - Directory Escape Vulnerability

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

CVE-2026-55062: Improper Limitation of a Pathname to a Restricted Directory

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

CVE-2026-55061: Improper Neutralization of Argument Delimiters in a Command

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-87028

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

CVE-2026-87028 Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

CVE-2026-87028 Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration in the Admin user-edit PATCH process. An attacker can maintain unauthorized access by reusing a previousl...

EUVD-2026-80318

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...