PT-2026-91873

Name of the Vulnerable Software and Affected Versions proxy-addr versions 1.1.0 through 2.0.7 Description This Node.js module, which determines a request's client address behind trusted reverse proxies and supports Express req.ip and req.ips, contains a flaw where trust subnets written in...

PT-2026-98422

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

Wazuh 4.10.5

Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. This is the source code release...

PT-2026-93125

Name of the Vulnerable Software and Affected Versions tts-be versions prior to 2.1.0 Description Broken Access Control exists across several API endpoints, including '/api/student/id/photo' and '/api/course unit/id/exchange/metadata'. By chaining these unauthenticated endpoints, a remote attacker...

WordPress Design Scuole Italia plugin 1.0-2.17.3 - Open Redirect vulnerability

Open Redirect vulnerability discovered by ? in WordPress Theme Design Scuole Italia versions 1.0-2.17.3...

PT-2026-92171

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...

PT-2026-92726

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this...

CVE-2026-91772: URL Redirection to Untrusted Site

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

CVE-2026-89307: URL Redirection to Untrusted Site

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

FreeBSD : anki -- multiple vulnerabilities (ce54d883-b060-11f1-b187-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ce54d883-b060-11f1-b187-901b0edee044 advisory. Abdo Hasani reports: Imported note HTML may execute inside an embedded image-occlusion document that...

CVE-2026-88065: Exposure of Sensitive Information to an Unauthorized Actor

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

SUSE SLED15 / SLES15 Security Update : python-Authlib (SUSE-SU-2026:4111-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4111-1 advisory. This update for python-Authlib fixes the following issue: - CVE-2026-41479: crafted authorization requests with...

CVE-2026-44793: Improper Neutralization of Input During Web Page Generation

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

CVE-2026-41573: Improper Neutralization of Special Elements used in an LDAP Query

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-45052: Improper Authorization

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm...

hoverfly v1.12.14

API simulations for development and testing Hoverfly is a lightweight, open source API simulation tool. Using Hoverfly, you can create realistic simulations of the APIs your application depends on. Replace slow, flaky API dependencies with realistic, re-usable simulations Simulate network latency...

CVE-2026-13277

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

CVE-2026-65838

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

CVE-2026-15412

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

CVE-2026-13277 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...