CVE-2026-55632 GoCD is vulnerable to authorization bypass via pipeline structure API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-52744

The GoCD continuous delivery server versions 20.2.0 through 26.1.0 is vulnerable to an authorization bypass in the internal UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream. Due to inadequate authorization of upstream dependency data, an authenticated user can retri...

CVE-2026-86867 Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

CVE-2026-86867 Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

CVE-2026-96655

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

DRUPAL-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

DRUPAL-CONTRIB-2026-165

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that...

CVE-2026-4921

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

EUVD-2026-85370

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-96656

Plex Media Server versions before 1.43.3.10861 are vulnerable to an arbitrary file write flaw. The issue arises because the TranscoderH264Options preference is appended verbatim to the x264 option string during every transcode. An admin user can exploit this to write arbitrary files that may be e...

EUVD-2026-85369

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

EUVD-2026-85362

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-6327

The IBM Concert software, versions 1.0.0 through 3.0.0 , is vulnerable to a flaw that allows an unauthorized user to inject data into log messages . This issue stems from the improper neutralization of special elements when they are written to log files. No specific exploit details or remediation...

CVE-2026-4921 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

EUVD-2026-85360

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2026-4921

IBM Guardium Data Protection 12.2 is affected by a vulnerability (CVE-2026-4921 ) that allows an administrative user to obtain sensitive information . This occurs when the system returns a detailed technical error message in the browser, which could subsequently be used to facilitate further atta...

CVE-2026-4921 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...