CVE-2026-82755: Use of Cache Containing Sensitive Information

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

CVE-2026-82584: Improper Neutralization of Escape, Meta, or Control Sequences

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...

CVE-2026-86497: Insertion of Sensitive Information Into Sent Data

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...

PT-2026-86929

Name of the Vulnerable Software and Affected Versions igniter versions 0.8.1 through 0.8.3 Description Improper neutralization of escape, meta, or control sequences allows a malicious package publisher to forge the mix igniter.install confirmation prompt. The panel builder in Igniter.Project.Deps...

CVE-2026-86481: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...

CVE-2026-86500: Incorrect Privilege Assignment

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

Malicious code in dune-forest-ewr577-project (npm)

The package dune-forest-ewr577-project was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-86182

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dmcommand causes cross-site request forgery. The attack may...

CVE-2026-86183

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widgetid leads to authorization bypass. The attack may...

CVE-2026-86183 diem-project diem dmWidget BasedmWidgetActions.class.php authorization

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widgetid leads to authorization bypass. The attack may...

CVE-2026-86183

diem-project diem (versions up to 5.1.3 ) contains an authorization bypass vulnerability in the dmWidget component, specifically in the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php. Manipulation of the widget_id argument allows a remote, unauthenticated attacker to bypass...

CVE-2026-86183 diem-project diem dmWidget BasedmWidgetActions.class.php authorization

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widgetid leads to authorization bypass. The attack may...

CVE-2026-86182 diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dmcommand causes cross-site request forgery. The attack may...

CVE-2026-86182 diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dmcommand causes cross-site request forgery. The attack may...

Exploit for SQL Injection in Glpi-Project Glpi

CVE-2025-24799 - GLPI SQL Injection Exploit Exploit para vuln...

PT-2026-86502

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget id leads to authorization bypass. The attack ma...

CVE-2026-86183: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widgetid leads to authorization bypass. The attack may...

CVE-2026-86182: Cross-Site Request Forgery (CSRF)

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dmcommand causes cross-site request forgery. The attack may...

CVE-2026-82752

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the...

CVE-2026-82752

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the...