FUXA security vulnerabilities

FUXA is a web-based process visualization software developed by frangoteam. Versions of FUXA 1.2.9 and earlier contain security vulnerabilities. These vulnerabilities stem from insecure default configurations, which may allow unverified remote attackers to gain administrator privileges and execut...

Birtech Senseway security vulnerabilities

Birtech Senseway is an environmental data monitoring platform developed by the Turkish company Birtech. Versions of Birtech Senseway from 09022026 onward contain security vulnerabilities. These vulnerabilities stem from insecure storage of sensitive information, which may lead to the retrieval of...

JSONPath security vulnerabilities

JSONPath is a JSONPath engine developed by David Chester as an individual contributor. There is a security vulnerability in JSONPath, which stems from the insecure evaluation of JSON Path expressions provided to users. This vulnerability may lead to arbitrary code injection, potentially causing...

CVE-2025-10464: Insecure Storage of Sensitive Information

Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the...

ROS-20260209-73-0015

Vulnerability in sssd related to insecure privilege management. Exploitation of the vulnerability could allow an attacker to escalate privileges...

CVE-2025-66607: Improperly Implemented Security Check for Standard

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains an insecure setting. Users could be redirected to malicious sites by an attacker. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVRN, UNSVRN, HMIWEB,...

ROS-20260209-73-0041

A vulnerability in the Agent component of the Zabbix IT infrastructure monitoring system is related to the use of an insecure search path. Exploitation of the vulnerability could allow an attacker to gain write access to arbitrary system files in the /home/cecuser directory...

ROS-20260209-73-0036

Vulnerability in pgbouncer related to the use of an insecure search path. Exploitation of the vulnerability could allow an attacker to escalate their privileges...

CVE-2026-1868: Improper Neutralization of Special Elements Used in a Template Engine

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...

PT-2026-7195

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.8 via the 'WCFMvm Memberships Payment Controller::processing' due to missing validation on a user controlled...

EUVD-2026-5705

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier...

CVE-2026-25563

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers...

CVE-2026-25567

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier...

CVE-2026-25563

CVE-2026-25563 affects WeKan versions prior to 8.19. The issue is an insecure direct object reference (IDOR) in checklist creation and related routes: the implementation does not verify that the supplied cardId belongs to the supplied boardId, enabling cross-board ID tampering. Public documents f...

CVE-2026-25563 WeKan < 8.19 Checklist Creation Cross-Board IDOR

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers...

CVE-2026-25563

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in checklist creation and related checklist routes. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers...

CVE-2025-13818

Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent...

CVE-2026-1228

The Timeline Block – Beautiful Timeline Builder for WordPress Vertical & Horizontal Timelines plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.3 via the tlgbshortcode function due to missing validation on a user controlled key. This...

SUSE CVE-2026-25060

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig function in internal/conf/config.go. This vulnerability enables...

SUSE CVE-2026-25499

Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment. Prior to version 0.93.1, in the SSH configuration documentation, the sudoer line suggested is insecure and can result in escaping the folder using ../, allowing any files on the system to be edited. This issue has been...