EUVD-2026-98931

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

CVE-2026-110098

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

CVE-2026-110098 Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

CVE-2026-55183

Prior to version 0.2.7 , RClone Manager (a cross-platform GUI for managing Rclone remotes) is vulnerable to an unauthenticated remote attack. The application launches the local rclone rcd service on 127.0.0.1:51900 using --rc-no-auth, --rc-allow-origin *, and --rc-serve. This configuration allows...

CVE-2026-55183 RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

CVE-2026-55183 RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

CVE-2026-55183 RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

EUVD-2026-98910

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

EUVD-2026-98841

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

CVE-2026-54640 OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

CVE-2026-54640 OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

Security Bulletin: IBM Terracotta is affected by Jetty vulnerabilities that could allow attackers to bypass security controls, hijack user sessions, or access unauthorized data

Summary IBM Terracotta utilizes Jetty as a lightweight Java-based web server and servlet container that allows developers to run web applications and provide machine-to-machine communications. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1...

CVE-2024-34319

A Server-Side Request Forgery SSRF in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request...

.NET Denial of Service Vulnerability

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

CVE-2026-90127

A flaw was found in the Linux kernel's virtio-rtc driver. This vulnerability occurs because alarm requests lack a timeout. A local attacker could exploit this by triggering a surprise removal of a virtio device while an alarm request is pending. This action causes the device removal process to ha...

CVE-2026-89202

A vulnerability exists in RUGGEDCOM CROSSBOW (all versions

BIT-GHOST-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

EUVD-2026-98078

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

EUVD-2026-98043

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

PT-2026-111780

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 5.2.0 through 5.2.1 FortiSandbox versions 5.0.0 through 5.0.6 FortiSandbox 4.4 affected versions not specified Description An uncaught exception in the Admin Profile occurs when handling exceptional conditions, which may...