PT-2026-96153

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260718 Description Authenticated non-administrator users can list and download system-configuration backups due to a missing administrator check in the endpoints 'scripts/lua/rest/v2/get/system/configurations/list...

PT-2026-95958

Name of the Vulnerable Software and Affected Versions NivoCart versions prior to 2.4.1 Description The 'forgotten.php' endpoint generates recovery codes using the substrmd5mt rand, 0, 10 method, resulting in predictable password reset tokens. An attacker with knowledge of an administrator's email...

CVE-2026-93989

The vLLM inference and serving engine (through version 0.29.0 ) is vulnerable to an Improper Validation of Array Index in the SamplingParams.update_from_tokenizer() function. A remote authenticated attacker can supply out-of-bounds bad_words token indices that fail to be validated against the mod...

CVE-2026-93989 vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

vLLM through 0.29.0 fails to properly validate badwords token indices against the model's generation output width in SamplingParams.updatefromtokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to...

PT-2026-102786

vLLM through 0.29.0 fails to properly validate bad words token indices against the model's generation output width in SamplingParams.update from tokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests...

PT-2026-95819

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit bad75bdd Description The software writes Model Context Protocol MCP authentication tokens, which are passed via URL query parameters, into plaintext application logs without redaction. This allows attackers w...

PT-2026-95873

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description The software fails to properly validate bad words token indices against the model's generation output width within the SamplingParams.update from tokenizer function. This allows attackers to provide...

CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-54642

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

EUVD-2026-81898

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-92920

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

CVE-2026-44940

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observabili...

CVE-2026-92920: Insufficient Session Expiration

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

CVE-2026-44940: Cleartext Storage of Sensitive Information

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observabili...

CVE-2026-92918: Insertion of Sensitive Information into Log File

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...

CVE-2026-75523: Exposure of Sensitive Information to an Unauthorized Actor

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-92810

PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read...

CVE-2026-92794

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identit...

CVE-2026-92764

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intende...

CVE-2026-92810

PrestaShop blockwishlist module through version 3.0.2 contains an Insecure Direct Object Reference (IDOR) in the getUrlByIdWishListAction method. The module fails to validate wishlist ownership, so any authenticated customer can supply sequential wishlist identifiers to retrieve valid share token...