CVE-2026-42137 Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, pages.access/list and files.access/list permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-8115

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in path traversal. The attack can be launched remotely. The...

CVE-2026-42137: Missing Authorization

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, pages.access/list and files.access/list permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-8198: Exposure of Sensitive Information to an Unauthorized Actor

The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an...

com.oviva.telematik:epa4all-rest-service (0.0.5) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (0.0.5)

com.oviva.telematik:epa4all-client MAVEN version 0.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.5 Source cves: CVE-2026-44900 Source advisory:...

com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.0), com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.0) +2 more potentially affected by CVE-2026-44900 via com.oviva.telematik:vau-httpclient (>=1.0.0, <=1.2.0)

com.oviva.telematik:vau-httpclient MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2026-44900 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17157661...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.0) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.0)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2026-44900 Source advisory: OSV:GHSA-G8R3-5HWF-QP96...

com.oviva.telematik:epa4all-rest-service (0.0.4) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (0.0.4)

com.oviva.telematik:epa4all-client MAVEN version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.4 Source cves: CVE-2026-44900 Source advisory:...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.0) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.0)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2026-44900 Source advisory: GHSA-G8R3-5HWF-QP96...

com.oviva.telematik:epa4all-rest-service (0.0.8) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (0.0.8)

com.oviva.telematik:epa4all-client MAVEN version 0.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.8 Source cves: CVE-2026-44900 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.7) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (0.0.7)

com.oviva.telematik:epa4all-client MAVEN version 0.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.7 Source cves: CVE-2026-44900 Source advisory:...

EUVD-2026-28543

The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sky-custom-scripts custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with capabilitytype = 'post' and showinrest = true, combined with...

CVE-2026-7475

The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sky-custom-scripts custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with capabilitytype = 'post' and showinrest = true, combined with...

CVE-2026-7475

The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sky-custom-scripts custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with capabilitytype = 'post' and showinrest = true, combined with...

CVE-2026-42150

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0...

SUSE CVE-2026-41519

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cyclesessionkeys", but DRF API tokens "wlu" prefix stored in "authtokentoken" are not revoked. This issue has been patched in version 5.17.1...

CVE-2026-42271: Improper Neutralization of Special Elements used in a Command

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration i...

PT-2026-38904

Name of the Vulnerable Software and Affected Versions Sky Addons versions prior to 3.3.3 Description The Sky Addons plugin for WordPress allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts. This occurs because the sky-custom-scripts custom post type i...

CVE-2026-42150: Improper Neutralization of Input During Web Page Generation

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0...

ELADMIN security vulnerabilities

ELADMIN is a backend management system developed by elunez himself. Versions of ELADMIN 2.7 and earlier had security vulnerabilities. These vulnerabilities stemmed from an improper access control caused by the checkLevel operation in the Users API Endpoint component’s /file/rest/UserController.ja...