CVE-2026-101168 Insertion of Sensitive Information into Log File in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to...

CVE-2026-101168: Insertion of Sensitive Information into Log File

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to...

PT-2026-111159

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.0 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description An issue exists where sensitive request data is inserted into log files and error tracking events. This...

CVE-2026-109524: Missing Authorization

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...

CVE-2026-109671

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

CVE-2026-109671 Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

CVE-2026-109671

Frappe ERPNext versions before 15.113.0 and 16.x before 16.24.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is a profile field that renders content without proper escaping into portal pages. A low-privilege attacker can inject a malicious script into this field, whi...

CVE-2026-109671 Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

CVE-2026-109352 LibreNMS before 26.9.0 Stored XSS via wireless sensor description

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

CVE-2026-109352

LibreNMS versions prior to 26.9.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in includes/html/pages/device/wireless.inc.php. The root cause is the lack of proper output escaping when the application echoes sensor_descr values, which are populated from SNMP Display...

K000163659: Next.js vulnerability CVE-2026-75604

Security Advisory Description Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route...

CVE-2026-109671: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

CVE-2026-109352: Improper Neutralization of Input During Web Page Generation

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

CVE-2026-108720 phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...

testenv

Entorno de pruebas de inyección SQL Una colección de páginas web vulnerables a fallos de inyección SQL y más: conf/ - archivos de configuración del sistema operativo utilizados por deployment.sh. dbs/ - bases de datos independientes para algunos sistemas de gestión de bases de datos p. ej...

CVE-2026-106029: Missing Authorization

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: hubble-ui, continuity, ingress-nginx-controller, k6, filebrowser, juicefs, loki, terragrunt, argo-workflows, step, kubernetes, kyverno-policy-reporter-ui, flux, grafana, rancher, kyverno-policy-reporter, prometheus-adapter, cert-manager, k8s-device-plugin,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: hubble-ui, continuity, ingress-nginx-controller, k6, filebrowser, juicefs, loki, terragrunt, argo-workflows, step, kubernetes, kyverno-policy-reporter-ui, flux, grafana, rancher, kyverno-policy-reporter, prometheus-adapter, cert-manager, k8s-device-plugin,...

CVE-2026-107850

The Contao Open Source CMS is vulnerable to improper access control in the preview links module from versions 5.7.1 until 5.7.12 . The root cause is a configuration error in core-bundle/config/services.yaml, where the preview access voter is registered under an incorrect class name. This causes S...

CVE-2026-107850 Contao: Improper access control in the preview links module

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...