EUVD-2026-69998

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...

CVE-2026-81205 LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...

CVE-2026-81205

CVE-2026-81205 is an LDAP Injection vulnerability in the Drupal LDAP / Active Directory Integration contrib module (versions 0.0.0 through 2.2.1 ). The module enables user authentication via LDAP or Active Directory but does not sufficiently sanitize user-supplied input before incorporating it in...

CVE-2026-14215

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-14215

The Booking for Appointments and Events Calendar WordPress plugin (Amelia) versions before 2.4.9 is vulnerable to an unauthenticated post-booking action trigger. The root cause is a lack of authentication or valid request token verification before executing the post-booking action chain . An unau...

secretlint v13.0.5

Secretlint Secretlint is a Pluggable linting tool to prevent committing credentials. Features Scanner : Find credentials in a project and report these Project Friendly: Easy to set up your project and integrate CI services Pre-Commit Hook : Prevent committing credential files Pluggable : Allow...

dbeaver v26.2.0

DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...

CVE-2026-20212: Binding to an Unrestricted IP Address

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 L3 virtual routing and...

CVE-2026-8151: Cross-Site Request Forgery (CSRF)

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

CVE-2026-81205: Improper Neutralization of Special Elements used in an LDAP Query

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...

F5 Networks BIG-IP : BIG-IP Edge Client on Windows security exposure (K000162417)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4. It is, therefore, affected by a vulnerability as referenced in the K000162417 advisory. The BIG-IP Edge Client Dialup Entry/Windows Logon Integration may expose native Windows operating system...

CVE-2026-78608

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

CVE-2026-78608

CVE-2026-78608 is a Missing Authorization (CWE-862) vulnerability in Kibana , where an internal APM integration function lacked a proper authorization check. This allowed any authenticated Kibana user to read APM server credentials that should only be accessible to users with APM or Fleet adminis...

CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

EUVD-2026-69569

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

CVE-2026-84189

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...