PT-2026-108965

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Ordinary authenticated users can access the /api/nodes and /api/nodes/:id endpoints, which return node objects containing a sensitive token field. This token is used as a shared credential for...

PT-2026-108966

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description The self-upgrade mechanism validates downloaded binaries using a same-origin digest obtained from the same upgrade mirror. A compromised mirror or a network attacker capable of altering both...

PT-2026-108964

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description An authenticated user with permissions to create and restore backups can perform an arbitrary file write. The issue occurs because the internal/backup/restore.go file extracts inner archives...

PT-2026-108956

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.5.0 Description Nginx UI accepts the Node.Secret master credential via the node secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. This allows the...

PT-2026-108935

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.3.8 through 2.4.x Description An authenticated administrator with an active secure session can achieve remote code execution by exploiting the backup restore flow. By submitting attacker-controlled portable backup key...

PT-2026-108963

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Nginx UI contains a cross-site request forgery CSRF flaw where the AuthRequired middleware accepts a browser-managed cookie named token as a valid API credential. Because management endpoints d...

CVE-2026-107809: Cross-Site Request Forgery (CSRF)

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

GHSA-CW24-X4MJ-FW3Q Indico: Cross-Site-Scripting in minutes editor

Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set...

CVE-2026-78407

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...

CVE-2026-17189

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-11936

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...

EUVD-2026-95279

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-17189 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-17189

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to reflected cross-site scripting . This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI, which could alter intend...

CVE-2026-11936 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...

EUVD-2026-95266

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...

CVE-2026-78407 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...

CVE-2026-78407 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...

CVE-2026-78407

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to cross-site scripting (XSS) . An authenticated user can embed arbitrary JavaScript code in the Web UI, potentially altering functionality and leading to crede...

EUVD-2026-95264

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...