CVE-2026-46511

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...

VulnCheck KEV: CVE-2026-31816

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, redka, flux-image-reflector-controller, spicedb-operator, argocd-image-updater, cloudnative-pg, crossplane-provider-aws-ec2, kubernetes, zarf, amazon-cloudwatch-agent-operator, crossplane-provider-aws-sns, helm, runc, bento, kapp-controller,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, redka, flux-image-reflector-controller, spicedb-operator, argocd-image-updater, cloudnative-pg, crossplane-provider-aws-ec2, kubernetes, zarf, amazon-cloudwatch-agent-operator, crossplane-provider-aws-sns, helm, runc, bento, kapp-controller,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, redka, knative-serving, flux-image-reflector-controller, aws-flb-kinesis, harbor-scanner-trivy, kube-logging-operator-custom-runner, argocd-image-updater, spicedb-operator, cloudnative-pg, crossplane-provider-aws-ec2, kubernetes,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, redka, knative-serving, flux-image-reflector-controller, aws-flb-kinesis, harbor-scanner-trivy, kube-logging-operator-custom-runner, argocd-image-updater, spicedb-operator, cloudnative-pg, crossplane-provider-aws-ec2, kubernetes,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, redka, knative-serving, flux-image-reflector-controller, aws-flb-kinesis, harbor-scanner-trivy, kube-logging-operator-custom-runner, argocd-image-updater, spicedb-operator, cloudnative-pg, crossplane-provider-aws-ec2, kubernetes,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, redka, knative-serving, flux-image-reflector-controller, aws-flb-kinesis, harbor-scanner-trivy, kube-logging-operator-custom-runner, argocd-image-updater, spicedb-operator, cloudnative-pg, crossplane-provider-aws-ec2, kubernetes,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lightsail, aws-iam-authenticator-fips, istio, vault-secrets-operator, crossplane-provider-aws-memorydb-fips, nrdot-collector, crossplane-provider-aws-datasync-fips, crossplane-provider-aws-kafka, policy-controller, kro,...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lightsail, aws-iam-authenticator-fips, istio, vault-secrets-operator, crossplane-provider-aws-memorydb-fips, nrdot-collector, crossplane-provider-aws-datasync-fips, crossplane-provider-aws-kafka, policy-controller, kro,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lightsail, node-problem-detector, aws-iam-authenticator-fips, istio, mc-fips, vault-secrets-operator, crossplane-provider-aws-memorydb-fips, nrdot-collector, milvus, crossplane-provider-aws-datasync-fips, opa-fips-envoy, victorialogs,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lightsail, node-problem-detector, aws-iam-authenticator-fips, istio, mc-fips, vault-secrets-operator, crossplane-provider-aws-memorydb-fips, nrdot-collector, milvus, crossplane-provider-aws-datasync-fips, opa-fips-envoy, victorialogs,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lightsail, node-problem-detector, aws-iam-authenticator-fips, istio, mc-fips, vault-secrets-operator, crossplane-provider-aws-memorydb-fips, nrdot-collector, milvus, crossplane-provider-aws-datasync-fips, opa-fips-envoy, victorialogs,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lightsail, node-problem-detector, aws-iam-authenticator-fips, istio, mc-fips, vault-secrets-operator, crossplane-provider-aws-memorydb-fips, nrdot-collector, milvus, crossplane-provider-aws-datasync-fips, opa-fips-envoy, victorialogs,...

PT-2026-46853

Summary plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance without...

CVE-2026-10273

A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit h...

CVE-2026-10617

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...

EUVD-2026-34009

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...