EUVD-2026-34890

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...

CVE-2026-46511

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...

VulnCheck KEV: CVE-2026-31816

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: flannel, hubble-ui, kube-state-metrics, cluster-api, sealed-secrets, k3s, local-path-provisioner, crossplane-provider-aws-ec2, cloud-provider-azure, go, crossplane-provider-aws-cloudfront, docker-cli-buildx, grafana-rollout-operator, bento, fuse-overlayfs-snapshotter...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: flannel, hubble-ui, kube-state-metrics, cluster-api, sealed-secrets, k3s, local-path-provisioner, crossplane-provider-aws-ec2, cloud-provider-azure, go, crossplane-provider-aws-cloudfront, docker-cli-buildx, grafana-rollout-operator, bento, fuse-overlayfs-snapshotter...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: flannel, hubble-ui, kube-state-metrics, cluster-api, sealed-secrets, sops, k3s, local-path-provisioner, crossplane-provider-aws-ec2, cloud-provider-azure, go, golangci-lint, crossplane-provider-aws-cloudfront, docker-cli-buildx, grafana-rollout-operator, kaniko,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: flannel, hubble-ui, kube-state-metrics, cluster-api, sealed-secrets, sops, k3s, local-path-provisioner, crossplane-provider-aws-ec2, cloud-provider-azure, go, golangci-lint, crossplane-provider-aws-cloudfront, docker-cli-buildx, grafana-rollout-operator, kaniko,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: flannel, hubble-ui, kube-state-metrics, cluster-api, sealed-secrets, sops, k3s, local-path-provisioner, crossplane-provider-aws-ec2, cloud-provider-azure, go, golangci-lint, crossplane-provider-aws-cloudfront, docker-cli-buildx, grafana-rollout-operator, kaniko,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: flannel, hubble-ui, kube-state-metrics, cluster-api, sealed-secrets, sops, k3s, local-path-provisioner, crossplane-provider-aws-ec2, cloud-provider-azure, go, golangci-lint, crossplane-provider-aws-cloudfront, docker-cli-buildx, grafana-rollout-operator, kaniko,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-acm, etcd-fips, kapp-controller, crossplane-provider-aws-lightsail, flux-fips, crossplane-provider-aws-organizations, metrics-server, crossplane-fips, cloud-provider-gcp-cloud-controller-manager-fips,...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-acm, etcd-fips, kapp-controller, crossplane-provider-aws-lightsail, flux-fips, crossplane-provider-aws-organizations, metrics-server, crossplane-fips, cloud-provider-gcp-cloud-controller-manager-fips,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-acm, etcd-fips, kapp-controller, chronyexporter-fips, crossplane-provider-aws-lightsail, flux-fips, crossplane-provider-aws-organizations, metrics-server, crossplane-fips, manifest-tool,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: volsync-fips, newrelic-infra-operator, crossplane-provider-aws-acm, etcd-fips, kapp-controller, chronyexporter-fips, crossplane-provider-aws-lightsail, flux-fips, crossplane-provider-aws-organizations, metrics-server, crossplane-fips, manifest-tool,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-acm, etcd-fips, kapp-controller, chronyexporter-fips, crossplane-provider-aws-lightsail, flux-fips, crossplane-provider-aws-organizations, metrics-server, crossplane-fips, manifest-tool,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: volsync-fips, newrelic-infra-operator, crossplane-provider-aws-acm, etcd-fips, kapp-controller, chronyexporter-fips, crossplane-provider-aws-lightsail, flux-fips, crossplane-provider-aws-organizations, metrics-server, crossplane-fips, manifest-tool,...

PT-2026-46853

Summary plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance without...

CVE-2026-10273

A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit h...

CVE-2026-10617

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...