PT-2026-93348

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get iodd port info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

PT-2026-93341

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with user or operator credentials can execute commands with root privileges on the device. This is possible through a command...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A high-privileged remote attacker can execute commands with root privileges on the device via a command injection flaw. This occurs when a crafted GET request is...

PT-2026-93688

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/xe component where the get flat ccs offset function incorrectly rounds up the base of the flat CCS Compression Cache Storage storage to 128K. This rounding...

PT-2026-93822

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description The SSE client-to-server POST endpoints are marked as @csrf exempt and the SSE GET stream endpoint lacks an Origin check. This allows a cross-origin page to manipulate a session authenticated by victim...

PT-2026-93352

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

PT-2026-94036

Name of the Vulnerable Software and Affected Versions Harness versions prior to 3.3.0 Description Authenticated users can retrieve provider configurations from spaces to which they do not belong due to missing access control validation in the infrastructure provider read endpoint. By querying the...

PT-2026-93707

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description An authorization failure exists in the 'GET /admin-api/system/user/page' endpoint because the @PreAuthorize annotation is commented out. This allows authenticated back-office users who lack the...

CVE-2026-92569: Server-Side Request Forgery (SSRF)

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

CVE-2026-92463: Missing Authorization

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

PT-2026-93440

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where preemption is not properly disabled during the execution of the bpf get stackid function. Specifically, the get perf callchain call requires...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-88f6-4rjv-x774. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET...

Malicious Package

Overview get-power is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-91994

Semaphore UI through 2.19.12 contains a missing authorization vulnerability in the GetMustCanMiddleware component. The middleware exempts GET and HEAD requests from project resource permission checks, allowing attackers with guest or task_runner roles to read all project environments—including pl...

CVE-2026-91994 Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

EUVD-2026-78434

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-52823

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...

CVE-2026-52823

Kimai , an open-source time tracking application, contains an authenticated CSRF vulnerability in its TimesheetController (src/API/TimesheetController.php). Prior to version 2.58.0 , the stop and restart operations were exposed as GET requests without a request-forgery defense, while reusing the ...