Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

PT-2026-97678

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

PT-2026-97355

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Stored cross-site scripting occurs in the FTM UI NetworkAcknowledgement React component within the file NetworkAcknowledgement.jsx:42. A...

CVE-2026-63002: Improper Neutralization of Input During Web Page Generation

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

PT-2026-97329

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.2 Description A stored cross-site scripting XSS issue exists in the REDAXO content management system. The mediaIsInUse function in redaxo/src/addons/media manager/lib/media manager.php, when invoked through the...

PT-2026-97446

Name of the Vulnerable Software and Affected Versions WSP MCP – AI Agents Connector versions prior to 2.7.1 Description Broken access control allows contributors to perform unauthorized actions within the system. Recommendations Update WSP MCP – AI Agents Connector to version 2.7.1 or later...

CVE-2026-86681: Missing Authentication for Critical Function

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

CVE-2026-18875: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert CWE-74 in the FTM AI agent server api.vectordb.runbooks.js:51. An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer...

CVE-2026-18364: Missing Authorization

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

CVE-2026-18177: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks...

CVE-2026-63001: Improper Neutralization of Input During Web Page Generation

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse handler in redaxo/src/addons/mediamanager/lib/mediamanager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIAISINUSE. An administrator with Media...

CVE-2026-18872: Improper Neutralization of Input During Web Page Generation

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

PT-2026-97322

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks...

CVE-2026-18074

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization...

CVE-2026-18066

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-17635

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...

CVE-2026-17643

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials...

CVE-2026-18074

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to perform unauthorized actions . This security flaw stems from improper authentication and missing authorization within the software. The risk is characterized by an...

CVE-2026-18074 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization...