CVE-2026-67207

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

CVE-2026-67206

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

CVE-2026-67206 Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

EUVD-2026-51291

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

CVE-2026-67206

Wolf CMS 0.8.3.1 contains an authenticated RCE in FileManagerController due to missing file extension validation in create_file() and save(). Attackers with the file_manager_mkfile capability can write arbitrary PHP into the web-accessible FILES_DIR and trigger execution via HTTP. CVSS data indic...

SUSE CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

SUSE CVE-2026-49821

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched...

CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...

CVE-2026-11771

OpenVPN vulnerability CVE-2026-11771 affects OpenVPN versions 2.1.0–2.6.20 and 2.7_alpha1–2.7.4. Root cause: an off-by-one buffer write in the NTLM proxy authentication handling, which can be triggered by a crafted NTLM response from a malicious proxy server. Impact: potential crash of the OpenVP...

CVE-2026-28812 Apache JSPWiki: UserManager does not sanity-check user database at startup

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue...

CVE-2026-28812

CVE-2026-28812 affects Apache JSPWiki (up to version 2.12.3). The root cause is that the JSPWiki UserManager does not perform proper sanity checks on the user database at startup, enabling impersonation and potential privilege escalation. Affected component: UserManager; impact: authentication/au...

CVE-2026-11707

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page...

CVE-2026-11707 Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page...

CVE-2026-11707

CVE-2026-11707 affects IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager 4.1. The issue is a cross-site scripting vulnerability in the administrative console login page. IBM bulletins for this family (CVE-2026-11594, CVE-2026-11707, CVE-2026-11383) documen...

EUVD-2026-51141

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page...

CVE-2026-11383

Summary of CVE-2026-11383 : IBM WebSphere Application Server (WAS) is affected by cross-site scripting (XSS) in the Administrative Console when shipped with Tivoli System Automation Application Manager 4.1 and related bundles. Connected documents confirm affected WAS versions include 8.5 and 9.0 ...

EUVD-2026-51140

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console...

CVE-2026-11383 Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console...

MAL-2026-11366 Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

CVE-2026-15397

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wpssfwinstallpluginconfiguration AJAX handler. This...