Jenkins Confidential Data Storage Unauthorized Access

The vulnerability of the confidential data storage mechanism in the Jenkins automation server configuration is related to the lack of measures taken to encrypt secret data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected...

Kibana Authentication Bypass Unauthorized Access

The vulnerability of the Kibana data visualization service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Kibana Visualization Unauthorized Access

The vulnerability of the Kibana visualization service’s object identifier handling mechanism relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Kibana Data Visualization Service Access Control Unauthorized Access

The vulnerability of the access control mechanism of the Kibana data visualization service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Perl-Crypt-DSA Digital Signature File Access Unauthorized Information Disclosure

The vulnerability of the Perl-Crypt-DSA digital signature package relates to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

dnsdist handleCORS() Unauthorized Access

The vulnerability of the handleCORS function in the pdns/dnsdistdist/dnsdist-web.cc load balancer and proxy for DNS traffic is related to the use of an untrusted domain policy file. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

Perl-Crypt-DSA Insufficient Randomness Unauthorized Access

The vulnerability of the Perl-Crypt-DSA digital signature package is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

BuildKit Path Traversal

The vulnerability of the BuildKit container-building software is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to protected information...

Erlang/OTP Path Traversal Unauthorized Access

The vulnerability of the Erlang/OTP software platform is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Etcd RBAC Permission Bypass

The vulnerability of the RBAC permission checking mechanism when processing nested transaction operations for configuration store Etcd is related to deficiencies in the authorization mechanism. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to...

Netty Insufficient Randomness Unauthorized Access

The vulnerability of the framework used for developing network applications, servers, and client protocols based on Netty lies in the use of insufficiently random values. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Netty Encryption Unauthorized Access

The vulnerability of the framework for developing network applications, servers, and client protocols using Netty lies in the absence of the necessary encryption step. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

Elastic Defend Unauthorized Access

The vulnerability of the Elastic Defend component of the Kibana data visualization service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

MongoDB ldapQueryPassword Unauthorized Access

The vulnerability of the ldapQueryPassword parameter processing mechanism in the MongoDB database management system is related to the disclosure of information through registration files. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

PT-2026-99080

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description When creating or updating an email signature, the system processes inline images in the signature body. If an HTML img tag points to an existing attachment, the system copies that attachment into a ne...

PT-2026-99137

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.6.0 Description An issue exists where the search parameter at the '/employee/employee-filter-view' endpoint is reflected via the jQuery .html method in the employee/templates/employee nav.html file without proper HT...

PT-2026-98946

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description Zammad is a web-based open source helpdesk and customer support system. A flaw in the HTML sanitization process allows the injection of specific HTML elements into ticket bodies. When a user views a...

CVE-2026-89406: Missing Authorization

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-97898: Missing Authorization

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-44642: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...