PT-2026-66449

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...

PT-2026-66447

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

PT-2026-66448

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

CVE-2026-41939

Summary: CVE-2026-41939 affects Care Everywhere Gateway 14.3.10, where a hard-coded credential flaw in the bundled WildFly 8.2.0.Final management interface enables unauthenticated remote access to the WildFly admin console (port 20990) with default credentials. This allows deployment of a malicio...

CVE-2026-56407

An integer overflow exists in libexpat's doProlog function due to improper handling of entity value lengths. A local attacker could exploit this to execute arbitrary code or access sensitive system data. Mitigation To prevent exploitation explicitly disable all internal and external XML entity...

CVE-2025-67405

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...

CVE-2026-59688

The CVE-2026-59688 entry describes an OS Command Injection in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. An authenticated user with high privileges can execute arbitrary OS commands on the affected appliance via the backup restore functi...

CVE-2026-59686

Technical details for CVE-2026-59686 are not publicly available in the provided documents; monitor for updates from vendors for affected products and fixes.

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2020.1.11 12.1.11, 2021.0.9 13.0.9, 2021.1.7 13.1.7, 2022.0.7 14.0.7, 2022.1.8 14.1.8, and 2023.0.4 15.0.4, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized...

PT-2026-64902

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress Software ECS Connection Manager affected versions not specified Progress Software Object Scale Connection Manager affected versions not specified Progress Software MOVEit WA...

PT-2026-64901

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress ECS Connection Manager affected versions not specified Progress Object Scale Connection Manager affected versions not specified Progress MOVEit WAF affected versions not...

PT-2026-65095

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...

PT-2026-64904

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress ECS Connection Manager affected versions not specified Progress Object Scale Connection Manager affected versions not specified Progress MOVEit WAF affected versions not...

ethical-hacking-elewayte-projects

Ethical Hacking Projects — Elewayte Externship Penetration te...

CVE-2026-9765

Technical details for CVE-2026-9765 are not publicly available in the provided documents. Monitor for updates for any affected products, impact, and remediation information.

CVE-2026-9765 CVE-2026-9765 CVE Record

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized acce...

EUVD-2026-48526

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

React Router: Open redirect leading to XSS

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors...

CVE-2026-13183 RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values...

PT-2026-62777

Name of the Vulnerable Software and Affected Versions Oracle iReceivables versions 12.2.3 through 12.2.15 Description A flaw in the AR Web Utilities component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a complete...