PT-2026-69987

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 7.10.14 Rocket.Chat versions prior to 8.0.8 Rocket.Chat versions prior to 8.1.7 Rocket.Chat versions prior to 8.2.7 Rocket.Chat versions prior to 8.3.7 Rocket.Chat versions prior to 8.4.5 Rocket.Chat versions prio...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: redpanda-console, dagger, flux-operator-fips, flux-source-controller, xeol-fips, external-secrets-operator-fips, skaffold, pulumi-language-yaml, cloudbeat-fips, flux-fips, gomplate-fips, mapotf-fips, kubevela-fips, grafana, gitaly, pulumi, gitaly-fips, src-fingerprin...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: redpanda-console, dagger, flux-operator-fips, flux-source-controller, xeol-fips, external-secrets-operator-fips, skaffold, pulumi-language-yaml, cloudbeat-fips, flux-fips, gomplate-fips, mapotf-fips, kubevela-fips, grafana, gitaly, pulumi, gitaly-fips, src-fingerprin...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: redpanda-console, dagger, flux-operator-fips, flux-source-controller, xeol-fips, external-secrets-operator-fips, skaffold, pulumi-language-yaml, cloudbeat-fips, flux-fips, gomplate-fips, mapotf-fips, kubevela-fips, grafana, gitaly, pulumi, gitaly-fips, src-fingerprin...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: redpanda-console, dagger, flux-operator-fips, flux-source-controller, xeol-fips, external-secrets-operator-fips, skaffold, pulumi-language-yaml, cloudbeat-fips, flux-fips, gomplate-fips, mapotf-fips, kubevela-fips, grafana, gitaly, pulumi, gitaly-fips, src-fingerprin...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: guac, kubevela, nuclei, skaffold, snyk-cli, flux, syft, trufflehog, kaniko, steampipe, trivy, goreleaser, pulumi, tfsec, witness, gitsign, kubescape, bom, act, argo-events, argo-workflows, nfpm, pulumi-language-java, boring-registry, flux-source-controller,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: guac, kubevela, nuclei, skaffold, snyk-cli, flux, syft, trufflehog, kaniko, steampipe, trivy, goreleaser, pulumi, tfsec, witness, gitsign, kubescape, bom, act, argo-events, argo-workflows, nfpm, pulumi-language-java, boring-registry, flux-source-controller,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: guac, kubevela, nuclei, skaffold, snyk-cli, flux, syft, trufflehog, kaniko, steampipe, trivy, goreleaser, pulumi, tfsec, witness, gitsign, kubescape, bom, act, argo-events, argo-workflows, nfpm, pulumi-language-java, boring-registry, flux-source-controller,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: guac, kubevela, nuclei, skaffold, snyk-cli, flux, syft, trufflehog, kaniko, steampipe, trivy, goreleaser, pulumi, tfsec, witness, gitsign, kubescape, bom, act, argo-events, argo-workflows, nfpm, pulumi-language-java, boring-registry, flux-source-controller,...

CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47361

Datadog’s Android app exposes BubbleChatActivity (android:exported="true") with no permission guard, accepts SEND intents with mimeType text/plain, and reads a conversation_id from extras. On destruction, BubbleChatNotification.dismiss unconditionally cancels a hard-coded Bits AI notification (ID...

EUVD-2026-54567

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-15148

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

CVE-2026-15148 WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

EUVD-2026-54399

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...