CVE-2026-17635: Missing Authentication for Critical Function

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...

CVE-2026-18074: Improper Authentication

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization...

PT-2026-97082

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A server-side request forgery SSRF issue exists, which could allow a local attacker to obtain sensitive information and trigger unauthorized...

CVE-2026-59830 Discourse: Stored XSS via unescaped actor name in post actions

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action...

CVE-2026-48826 HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group i...

CVE-2026-62182 KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

CVE-2026-62371

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated...

EUVD-2026-83981

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...

CVE-2026-63416: Improper Limitation of a Pathname to a Restricted Directory

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...

PT-2026-96189

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.21.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 through 1.23.0 Description ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated...

CVE-2026-62371: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated...

PT-2026-96078

Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.25.0 through 1.30.x Description An authenticated user with write permissions in a single namespace can trigger unauthorized administrative actions by exploiting how the server identifies internal Workflow completion...

CVE-2026-62182: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

PT-2026-96183

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authorization flaw exists in the HandleWipeInventory function within the backend/app/api/handlers/v1/v1 ctrl actions.go file. The system authorizes the 'POST /v1/actions/wipe-inventory' endpoint...

CVE-2026-87840

The Tripzzy WordPress plugin (versions before 1.5.1 ) contains an improper access control vulnerability allowing unauthenticated booking data tampering. The plugin fails to perform necessary capability or ownership checks on administrative booking-management actions. These actions are exposed to ...

CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...

CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...