CVE-2026-94211 Hyve5 Leantime Project Dashboard show.blade.php cross site scripting

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...

EUVD-2026-83899

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...

CVE-2026-59306

A flaw was found in Spring Cloud Stream. This vulnerability involves the potential for deserialization of untrusted data. An attacker with high privileges and user interaction could exploit this to potentially impact the confidentiality and integrity of data. Mitigation To mitigate this issue,...

CVE-2026-59303

A flaw was found in Spring Cloud Stream where the dynamic destination cache size is not properly bound. This could lead to excessive memory consumption, potentially impacting system resources. An attacker with high privileges and user interaction could exploit this vulnerability over a network to...

WordPress User Submitted Posts plugin < 20260608 - Unauthenticated Stored XSS via Author Name vulnerability

Unauthenticated Stored XSS via Author Name vulnerability discovered by dangnosuy in WordPress Plugin User Submitted Posts versions 20260608...

CVE-2026-94152

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-94152 Omega Solution FBP Fulfillment by People User Profile API user authorization

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-94152

Omega Solution FBP Fulfillment by People 2025 contains an authorization bypass in the User Profile API (file /user/). The vulnerability is triggered by manipulating the ID argument , allowing a low-privileged remote user to access unauthorized user profiles. The impact is a low confidentiality lo...

CVE-2026-94152 Omega Solution FBP Fulfillment by People User Profile API user authorization

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

EUVD-2026-83866

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-15801 Cri-o: cri-o: insufficient validation during container checkpoint restore

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host...

CVE-2026-94213 Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...

kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

A flaw was found in the Linux kernel's RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface uAPI that cause an internal error. This issue arises when Work Queues WQs are specified to share the...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-94382: Authorization Bypass Through User-Controlled Key

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to...

CVE-2026-94404: Cross-Site Request Forgery (CSRF)

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker...

PT-2026-96305

Name of the Vulnerable Software and Affected Versions Pagekit CMS versions prior to 1.0.19 Description An unauthenticated attacker can perform SQL injection, a technique used to manipulate database queries, by submitting a malicious credentials array to the public login endpoint 'POST...

CVE-2026-88756: Improper Neutralization of Special Elements used in an SQL Command

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-61743: Reliance on Reverse DNS Resolution for a Security-Critical Action

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...

CVE-2026-94535: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...