CVE-2026-94376: Improper Neutralization of Input During Web Page Generation

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-98389

Name of the Vulnerable Software and Affected Versions Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress versions prior to 9.6.1.1 Description An issue exists where the maybe update user role function reads a target role from a Gravity Forms entry field, configured via...

PT-2026-99094

A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role id can lead to improper privilege...

CVE-2026-97647: Authorization Bypass Through User-Controlled Key

A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-96749

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built fr...

CVE-2026-97368

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

EUVD-2026-86469

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and...

CVE-2026-97368 chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-97368

A weakness exists in chillzhuang SpringBlade versions up to 5.0.2 , specifically within the UserServiceImpl.userInfo function located in the blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java file of the user-auth-info Endpoint . An attacker can remo...

CVE-2026-97368 chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

EUVD-2026-86467

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

Improper Verification of Cryptographic Signature

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the authcomplete method in the VKAppOAuth2 backend, where the authkey signature is not required to be...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

EUVD-2026-38570

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets...

CVE-2026-86857

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

CVE-2026-77293

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

CVE-2026-48073

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

GHSA-XHCR-J4J9-3GH7 Language Servers for AWS Vulnerable to Arbitrary Code Execution

Summary Language Servers for AWS the aws/language-servers project provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins Visual Studio Code, JetBrains, Eclipse, and Visual Studio. Improper trust boundary enforcement in Language...

Language Servers for AWS Vulnerable to Arbitrary Code Execution

Summary Language Servers for AWS the aws/language-servers project provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins Visual Studio Code, JetBrains, Eclipse, and Visual Studio. Improper trust boundary enforcement in Language...

EUVD-2026-86393

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...