CVE-2026-104414: Improper Neutralization of Input During Web Page Generation

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost...

CVE-2026-104411: Improper Neutralization of Input During Web Page Generation

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

Rocky Linux 10.2 [CIQ] Security Update: gvfs / gvfs-client / gvfs-client-debuginfo / gvfs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_73998)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673998 advisory. gvfs: SFTP: heap-based buffer overflow in readreply CVE-2026-84268 gvfs: gvfs-admin socket ownership race permits local root CVE-2026-88924 Tenable has...

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - An authentication bypass vulnerability exists in the API session-based authentication management of Cisco Catalyst SD-WAN Manager due to improper handling of URI encoding hex encoding in HTTP...

Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc Multiple Vulnerabilities (crlsa-2026_73765)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673765 advisory. pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogta...

PT-2026-104138

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed – Simple Social Feeds for WordPress versions prior to 4.13.1 Description Insufficient input sanitization and output escaping in the Admin Builder Preview allow unauthenticated attackers to perform Stored Cross-Si...

CVE-2026-104625: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-103956: Missing Authentication for Critical Function

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-104416: Observable Discrepancy

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

PT-2026-104064

Name of the Vulnerable Software and Affected Versions itsourcecode Pet Shop Management System version 1.0 Description A SQL injection issue exists in the admin reject completed.php file. This occurs when the ID argument is manipulated, allowing a remote attacker to execute unauthorized database...

PT-2026-104480

Armadin researcher @mhskai2017 has uncovered two authenticated RCE vulnerability affecting Dell OpenManage Integration and Lenovo XClarity Integration with Windows Admin Center CVE-2026-101207 and CVE-2026-65949, both High severity CVSS 8.8. A domain user credential is enough to gain SYSTEM on th...

PT-2026-104346

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument g name results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

PT-2026-104157

🗄️ Dell Container Storage Modules pre-1.18.0: unauthenticated remote attackers can exploit a missing auth flaw for full system compromise. CVSS 10. Patch to v1.18.0 now. CVE-2026-63692 cybersecurity ciso cto vulnerabilities msp https://t.co/tMaeKALtuo https://t.co/qILVHlphmR...

PT-2026-104156

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules CSM versions prior to 1.18.0 Description The csm-authorization-storage gRPC server lacks authentication for a critical function. This allows an unauthenticated remote attacker to gain unauthorized access to stora...

PT-2026-104224

Name of the Vulnerable Software and Affected Versions Ghost versions 5.94.0 through 6.63.0 Description A stored cross-site scripting issue exists that allows staff users, such as Contributors, to host arbitrary HTML. This is achieved by abusing the bookmark card image fetching mechanism, where...

PT-2026-104227

Name of the Vulnerable Software and Affected Versions Ghost versions 4.39.0 through 6.63.x Description An information disclosure issue exists in the Admin API that allows staff users to view secret tokens associated with pending staff invites. Staff users who possess invite viewing permissions ca...

PT-2026-104226

Name of the Vulnerable Software and Affected Versions Ghost versions 0.7.2 through 6.63.0 Description An information disclosure issue exists in the Admin API that allows authenticated staff-level users to determine the relative ordering of password hashes belonging to other staff users. This is...

PT-2026-104417

Name of the Vulnerable Software and Affected Versions Loom for AWS versions prior to 1.6.1 Description A missing authentication for a critical function in the authentication dependency allows remote actors to obtain super-admin authority over the agent control plane. This occurs in deployments...

PT-2026-104448

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-104478

Name of the Vulnerable Software and Affected Versions Dell OpenManage Integration with Microsoft Windows Admin Center versions prior to 3.7.0 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A low privileged attacker with...