CVE-2026-65926

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

EUVD-2026-57273

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-64639

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-65926 Private Release Bundle versions may be disclosed under specific configurations

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

EUVD-2026-57257

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-65926

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-65926

Technical details (affected product/versions/exploitability) are not publicly provided in the supplied documents. Monitor for updates from vendor advisories and trusted sources.

CVE-2026-66375

CVE-2026-66375 concerns JFrog Artifactory metadata : a low-privilege authenticated user can permanently remove protected internal metadata across repositories under specific conditions. The issue is described across multiple sources (NVD, CVE Registry) with related CVSS 3.1 data: AV:N/AC:L/PR:L/U...

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

EUVD-2025-210688

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution...

EUVD-2025-210694

Uncontrolled search paths in the Vitis™ Embedded Single File Download SFD for local Windows installation could allow a low-privileged user to create arbitrary code execution...

CVE-2025-0041

CVE-2025-0041 describes uncontrolled search paths in the Vitis Embedded Single File Download (SFD) installer for Windows. The issue could allow a low-privilege local user to achieve arbitrary code execution by abusing the DLL/loader search order and loading a malicious library or executable. The ...

EUVD-2026-56003

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

CVE-2026-58241

Technical details about CVE-2026-58241 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-72908

ERPNext contains an SQL injection in get_tax_template (erpnext/accounts/doctype/tax_rule/tax_rule.py) exploitable by an authenticated low-privilege user through request-influenced posting_date and args values. The issue affects pre-15.109.0 and pre-16.20.0 releases and can lead to extraction of s...

EUVD-2026-55666

Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default...

CVE-2026-72576

CVE-2026-72576 : Bludit 4.0.0-beta contains a stored XSS vulnerability exploitable by a low-privileged authenticated user (Author) who uploads a crafted SVG as the site logo. The flaw resides in the /admin/ajax/logo-upload.php path, which moves the uploaded file directly to the web root via Files...

CVE-2026-18666

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

PT-2026-69867

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description A low-privileged user can submit crafted content to the moderation review queue. Th...

EUVD-2026-53429

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...