CVE-2026-55082 DHIS2 SQL injection in SQL View filter values

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...

CVE-2026-44228

A flaw was found in RT, an issue and ticket tracking system. This stored Cross-Site Scripting XSS vulnerability allows an authenticated user to inject malicious JavaScript code into the system. When another user views the affected page, the injected script executes, potentially leading to...

CVE-2026-15342 CVE-2026-15342

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned...

CVE-2026-59851

A vulnerability in libssh affects servers with GSSAPIKeyExchange enabled. The gssapi-keyex path does not verify that the authenticated Kerberos principal is authorized for the requested local user, enabling authenticated clients to log in as arbitrary users. This is reported across multiple sourc...

CVE-2026-59851

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

EUVD-2026-46155

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to...

PT-2026-62095

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An inconsistency in the file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments from feature areas they are not authorized t...

PT-2026-63281

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An issue exists in the OAuth2 sign-in callback that allows a deactivated user account to be reactivated when signing in through an authentication source that does not issue refresh tokens, such...

PT-2026-63316

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4 Description A flaw allows users whose access has been revoked to continue accessing private information through specific endpoints. A former collaborator can enumerate private repositories they previously starred and read...

PT-2026-62410

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can access and modify Cloud Connect configuration and service settings without the necessary feature privileges. This occurs due to missing authorization in product...

PT-2026-63260

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An issue involving an incomplete list of disallowed inputs in the Reporting feature allows an authenticated attacker to bypass outbound request restrictions. This can lead to Server-Side Reque...

CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server...

CVE-2026-55544

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

CVE-2026-47129

Summary of CVE-2026-47129 (NextCRM) : NextCRM versions prior to 0.12.0 contain a Broken Access Control flaw in the Next.js Server Actions activateUser/deactivateUser. The application does not verify that the requester has the admin role, allowing any authenticated user (even with member/viewer ro...

CVE-2026-56623 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server...

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

WordPress Tutor LMS Elementor Addons plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor plugin Activation vulnerability

Missing Authorization to Authenticated Subscriber+ Tutor LMS and Elementor plugin Activation vulnerability discovered by ? in WordPress Plugin Tutor LMS Elementor Addons versions = 4.0.0...

CVE-2026-44230

RT (Request Tracker) contains a reflected Cross‑Site Scripting (XSS) vulnerability in search results/chart rendering. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 are affected if an authenticated user is induced to visit a crafted URL, enabling arbitrary ...

CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...