CVE-2026-70369

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

CVE-2026-70369 Koha - SQL Injection in reports/acquisitions_stats.pl

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

CVE-2026-70369

Koha vulnerability CVE-2026-70369 affects the reports/acquisitions_stats.pl workflow. The per-cell statistics query is built by interpolating user-controlled Filter parameters directly into WHERE clauses (covering fields like aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.ho...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

EUVD-2026-52174

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

Virtuozzo Infrastructure 7.4 Hotfix 1 (7.4.0-75)

This update provides stability fixes. Vulnerability id: VSTOR-102068, VSTOR-102069, VSTOR-138302 Creating a VM in a server group could fail with "No valid host found" because a previously canceled or failed VM remained in the server group. Vulnerability id: VSTOR-120923 VPN could stop working whe...

CVE-2026-15227

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

CVE-2026-15227 Missing Authorization Allows Editing of Foreign Reports

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

CVE-2026-15227

Summary: CVE-2026-15227 affects Checkmk prior to versions 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 (EOL). An authenticated user who lacks the "Edit foreign Reports" permission can modify reports owned by other users due to missing authorization. What’s affected: Checkmk installations running the l...

EUVD-2026-51529

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

EUVD-2026-51314

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and cop...

PT-2026-66752

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

CVE-2026-68562

CVE-2026-68562 affects the ansible-collection-redhat-leapp. A privileged attacker who can write to a managed node’s Leapp report can tamper the report; when an operator runs a remediation task, the Ansible controller may read its own local files and copy them to the managed node, causing informat...

CVE-2026-68562

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and cop...

CVE-2026-4672

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to...

CVE-2026-4672

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to...

CVE-2026-4672

GitLab CVE-2026-4672 affects GitLab CE/EE: 18.4.x before 19.0.5, 19.1.x before 19.1.3, and 19.2.x before 19.2.1. An authenticated user with guest permissions could access test report contents they were not authorized to view due to improper access control enforcement. The issue has been remediate...

CVE-2026-4672 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to...

CVE-2026-4672 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to...