CVE-2026-62111: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...

CVE-2026-62106: Incorrect Privilege Assignment

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-62103: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-62102: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-90457: Use of Password Hash With Insufficient Computational Effort

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

CVE-2026-90454: Missing Authorization

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90452: Improper Certificate Validation

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-90451: Use of Default Credentials

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

CVE-2026-90450: Incorrect Authorization

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90449: Missing Authentication for Critical Function

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

CVE-2026-90447: Authentication Bypass by Spoofing

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90446: Server-Side Request Forgery (SSRF)

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

CVE-2026-90444: Improper Neutralization of Special Elements used in an OS Command

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90443: Improper Neutralization of Input During Web Page Generation

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...

CVE-2026-80469: Improper Verification of Cryptographic Signature

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required...

CVE-2026-81754: Improper Neutralization of Input During Web Page Generation

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-84390: Inclusion of Sensitive Information in Source Code

A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via...

CVE-2026-8303: Incorrect Privilege Assignment

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation. This issue affects Pardus-software: before 1.0.5...

CVE-2026-78129: Loop with Unreachable Exit Condition

strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS5 decryption...

CVE-2026-11765: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Argument Injection. This issue affects Pardus Pen: before 4.2.1...