yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications

A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document,...

Vulnerability in core server (CVE-2026-16239)

PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions...

CVE-2026-59501: Improper Access Control

: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59507: Use of Hard-coded Credentials

: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solution...

CVE-2026-59506: Missing Authentication for Critical Function

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59505: Improper Access Control

: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59503: Exposure of Sensitive Information to an Unauthorized Actor

: Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Sof...

CVE-2026-59502: Observable Discrepancy

: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59500: Improper Authentication

: Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59499: Exposure of Sensitive Information to an Unauthorized Actor

: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions.. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions.: All versions without Priwall v3...

CVE-2026-16239: Access of Resource Using Incompatible Type

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-59504: Client-Side Enforcement of Server-Side Security

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-18247

The CVE-2026-18247 describes a DOM-based XSS in BlackBerry AtHoc Web Portals (AtHoc IWS). Affected versions are earlier than 7.21 HF-734; exploitation could allow an attacker to perform actions in the victim’s session. Remediation is to upgrade to 7.21 HF-734 or later. The available connected doc...

CVE-2026-18247 DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals

A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...

CVE-2026-72535

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

EUVD-2026-56005

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

CVE-2026-72535

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

CVE-2026-72535

CVE-2026-72535 affects Chaskiq. A missing authentication flaw (through commit 46dfdd1) allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication/authorization checks before c...

CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...