CVE-2026-86768: Improper Input Validation

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86759: Missing Authorization

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

PT-2026-88854

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...

CVE-2026-79323: Exposure of Sensitive Information to an Unauthorized Actor

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

CVE-2026-71805: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

CVE-2026-87011: Asymmetric Resource Consumption (Amplification)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

PT-2026-88792

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-86753: Incorrect Authorization

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

CVE-2026-87821: Server-Side Request Forgery (SSRF)

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-86746: Improper Privilege Management

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

PT-2026-88849

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-88873

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-87808: Protection Mechanism Failure

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

CVE-2026-49883

creationtimestamp| type| source ---|---|--- 2026-09-08 22:11:27+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv2243bjm22w 2026-09-09 22:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4l2fy3k422 2026-09-15 02:37:07+00:00| seen|...

CVE-2026-19232

creationtimestamp| type| source ---|---|--- 2026-09-08 22:11:02+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv223d3mah2j 2026-09-09 11:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv3htw4ckn2y 2026-09-10 09:18:55+00:00| seen|...

CVE-2026-69527

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:58+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:46+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:16:35+00:00|...

CVE-2026-69770

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:38+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:21+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:46:06+00:00|...

CVE-2026-69383

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:30+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:15+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:18:46+00:00|...

CVE-2026-69475

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:18+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:01+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:47:43+00:00|...

CVE-2026-69838

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:05+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:44+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:51:23+00:00|...