CVE-2026-65644

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

CVE-2026-16323: Execution After Redirect (EAR)

Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...

PT-2026-79310

Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...

CVE-2026-63003

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:15+00:00| published-proof-of-concept| https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr...

GHSA-H54R-XQ46-QWQM Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Impact The Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not...

CVE-2026-76998

CVE-2026-76998 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 , located in the file /admin/ajax.php when the action=delete_category parameter is used. Manipulation of the ID argument allows an unauthenticated remote attacker to inject SQL commands. The v...

CVE-2026-76564

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

CVE-2026-76564

PhocaCart (Joomla extension) versions 5.0.0–6.1.7 are affected by a Stored XSS (CWE-79) in the admin order view. When the non-default store_user_agent option is enabled, the raw User-Agent header from checkout requests is stored unsanitized in the orders database and rendered without HTML encodin...

CVE-2025-52182

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

PT-2026-79016

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-55087 Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control...

EUVD-2026-62721

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control...

CVE-2026-62670

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

Malicious code in dxrs-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33 Package is an openly-advertised DDoS/booter toolkit L4/L7 flood methods, SSH brute force, C2 panel builder with keywords such as "ddos attack script"...

Malicious code in dxr-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f bin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an...

CVE-2026-54347

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:28+00:00| published-proof-of-concept| https://github.com/froxlor/froxlor/security/advisories/GHSA-43gm-9rr3-cx7g...

CVE-2026-55593

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:23+00:00| published-proof-of-concept| https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j 2026-08-19 11:32:39+00:00| seen| https://gist.github.com/alon710/3948341428804c685cf1bc5b4fc0d3f1...

CVE-2026-60884

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Panel Processor. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

EUVD-2026-61457

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Panel Processor. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...