CVE-2026-107806: Improper Control of Generation of Code

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

CVE-2026-107805: Uncontrolled Resource Consumption

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...

PT-2026-108934

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.5.0 through 2.5.x Description The node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it to disk before validating the body digest and cryptographic...

PT-2026-108965

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Ordinary authenticated users can access the /api/nodes and /api/nodes/:id endpoints, which return node objects containing a sensitive token field. This token is used as a shared credential for...

PT-2026-108966

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description The self-upgrade mechanism validates downloaded binaries using a same-origin digest obtained from the same upgrade mirror. A compromised mirror or a network attacker capable of altering both...

PT-2026-108964

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description An authenticated user with permissions to create and restore backups can perform an arbitrary file write. The issue occurs because the internal/backup/restore.go file extracts inner archives...

PT-2026-108956

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.5.0 Description Nginx UI accepts the Node.Secret master credential via the node secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. This allows the...

PT-2026-108935

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.3.8 through 2.4.x Description An authenticated administrator with an active secure session can achieve remote code execution by exploiting the backup restore flow. By submitting attacker-controlled portable backup key...

PT-2026-108963

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Nginx UI contains a cross-site request forgery CSRF flaw where the AuthRequired middleware accepts a browser-managed cookie named token as a valid API credential. Because management endpoints d...

GHSA-CW24-X4MJ-FW3Q Indico: Cross-Site-Scripting in minutes editor

Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set...

CVE-2026-78407

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...

CVE-2026-17189

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-11936

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...

EUVD-2026-95279

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-17189 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-17189

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to reflected cross-site scripting . This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI, which could alter intend...

CVE-2026-11936 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...

EUVD-2026-95266

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...

CVE-2026-78407 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...

CVE-2026-78407 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...