CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848

Emlog , an open-source website building system, is affected by a stored XSS in versions 2.6.29 and prior . Tag names rendered in the article editor are not HTML-encoded. Because the application uses addslashes() instead of proper HTML entity encoding, a single quote (') stored in a tag name is de...

CVE-2026-16892

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching...

CVE-2026-16892 IBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching...

CVE-2026-16892

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by an improper authentication flaw (CWE-287) in the Network Authentication Service (NAS) , where a remote authenticated attacker can bypass security restrictions during service-name matching . The vulnerability carries a CVSS 3.1 score of 5.4 (ME...

EUVD-2026-71484

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching...

CVE-2026-16892 IBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching...

CVE-2026-17469

IBM i versions 7.3, 7.4, 7.5, and 7.6 are vulnerable to denial of service caused by an off-by-one write (CWE-787: Out-of-bounds Write) in the Line Printer Daemon (LPD) queue name parser . A local authenticated attacker can trigger the out-of-bounds write, resulting in a service disruption with a ...

CVE-2026-17469 IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser...

CVE-2026-19274

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

EUVD-2026-71273

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19274 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

zoneminder-rce-poc

just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...

CVE-2026-85602

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

MINI-MQJ6-4876-4RF3

Bulletin has no description...

CVE-2026-85405

Eleveo Call Recording Software 9.7.0 contains a cross-site scripting (XSS) vulnerability in the /callrec/roleAddAction.do endpoint. Manipulating the name/username argument allows a remote, authenticated attacker with user interaction to inject scripts, resulting in a low integrity impact. The exp...

CVE-2026-85405 Eleveo Call Recording Software roleAddAction.do cross site scripting

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may b...

PT-2026-85502

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...