CVE-2026-1662

Removed by vendor...

CVE-2026-1662

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint...

CVE-2026-1662

Summary: CVE-2026-1662 affects GitLab CE/EE prior to fixed versions. The issue could allow an unauthenticated user to cause a Denial of Service by sending specially crafted requests to the Jira events endpoint. Affected versions (per description): GitLab 14.4 before 18.7.5, 18.8 before 18.8.5, an...

CVE-2026-1662 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint...

PT-2026-21995

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.4 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4 GitLab CE/EE versions 18.9 through 18.9.0 Description An unauthenticated user could potentially cause a denial-of-service condition by sending specially crafte...

CVE-2026-1662: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint...

UBUNTU-CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2026-22596

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in...

CVE-2026-22596

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in...

CVE-2026-22596 Ghost has SQL Injection in Members Activity Feed

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in...

PT-2026-2218

Name of the Vulnerable Software and Affected Versions Ghost versions 5.90.0 through 5.130.5 Ghost versions 6.0.0 through 6.10.3 Description Ghost is a Node.js content management system. A flaw in the /ghost/api/admin/members/events API endpoint permits authenticated Admin API users to execute...

CVE-2025-41102

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/events/save'...

The vulnerability of the multi-platform web solution for creating Scada systems, Scada-LTS, is related to the lack of protective measures for the web page structure. This allows attackers to perform cross-site scripting attacks.

The vulnerability of the multi-platform web solution for creating Scada systems is related to the lack of protection for the web page structure when processing the alias parameter of the scheduledevents.shtm endpoint. Exploiting this vulnerability allows a remote attacker to perform cross-site...

PT-2023-32653 · Unknown · Bigprof Online Clinic Management System

Name of the Vulnerable Software and Affected Versions: BigProf Online Clinic Management System version 2.2 Description: A vulnerability has been discovered in the system, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the /clinic/events view.php...

Kitabisa Teler 跨站脚本漏洞

Kitabisa Teler is a software from the Kitabisa team for implementing intrusion detection and threat alerts based on web logs. A cross-site scripting vulnerability exists in versions prior to Kitabisa Teler 2.0.0-rc.4, which stems from the fact that log data displayed on the dashboard is not clean...

PT-2022-16008 · Teler · Teler

Name of the Vulnerable Software and Affected Versions: teler versions prior to 2.0.0-rc.4 Description: The teler dashboard is vulnerable to DOM-based cross-site scripting XSS when it requests messages from the event stream on the "/events" endpoint, and the log data displayed on the dashboard are...

PT-2022-24802 · Dendrite · Dendrite

Name of the Vulnerable Software and Affected Versions: Dendrite versions prior to 0.9.8 Description: The issue concerns events retrieved from a remote homeserver using the "/get missing events" path, where signatures were not verified correctly. This could allow a remote homeserver to provide...

CVE-2022-32376

itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/getevents.php?eventid=...

CVE-2021-41187

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the API endpoints for /api/trackedEntityInstances and api/events in DHIS2. The...