CVE-2026-92762: Missing Authorization

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92590: Improper Neutralization of Input During Web Page Generation

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...

CVE-2026-89824: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g. probe deferral and on driver unbind also if a devicetree redundantly uses the 'ddc-i2c-bus' property to point ...

CVE-2026-40854: Authentication Bypass by Spoofing

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/loginuser. An attacker can bypass authentication b...

Linux Distros Unpatched Vulnerability : CVE-2026-89824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g. probe deferral and on driver unbind also ...

PT-2026-93465

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An i2c adapter leak occurs in the drm/panel-edp component during probe failure, such as probe deferral, or during driver unbind. This happens when a devicetree redundantly uses the...

CVE-2026-81926

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-81926

Concrete CMS versions 9.4.0 through 9.5.2 contain a cross-site scripting (XSS) vulnerability in the location panel's duplicate-path confirmation dialog . When a page path collision occurs, the panel's check endpoint returns the submitted path unmodified in its JSON response, and client-side JavaS...

CVE-2026-79411

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

CVE-2026-56831

Shopper Framework (package shopper/framework), a headless e-commerce admin panel, is vulnerable to a business logic flaw (CWE-20) in versions prior to 2.9.0 . The /cpanel/discounts administrative interface accepts negative fixed_amount discount values without server-side validation, persisting th...

CVE-2026-56829 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

CVE-2026-56825

Shopper (a headless e-commerce admin panel) is vulnerable to an authorization bypass in the CollectionProducts Livewire component prior to v2.9.2 . Two defects combine: the per-record and bulk delete actions lack an ->authorize(...) guard, and the public $collection property is not marked #[Lo...

grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel

A flaw was found in the Grafana geomap panel's XYZ tile layer. An attacker with editor privileges can exploit a sanitize-then-interpolate ordering bug by setting a textbox variable's default value to a Cross-Site Scripting XSS payload. This payload executes for every user who opens the dashboard,...

grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel

A flaw was found in the Grafana geomap panel's XYZ tile layer. An attacker with editor privileges can exploit a sanitize-then-interpolate ordering bug by setting a textbox variable's default value to a Cross-Site Scripting XSS payload. This payload executes for every user who opens the dashboard,...

EUVD-2026-78161

Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name customAliasName because the Edit Alias dialog applied only trim to the submitted value and performed no input neutralization. An authenticated user holding canWrite editor permission on a page could store ...

CVE-2026-81926: Improper Neutralization of Input During Web Page Generation

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

PT-2026-92387

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

PT-2026-91845

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...