EUVD-2026-63203

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

CVE-2026-19615

The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 fails to sanitize SVG uploads on all accepted routes (including XML-RPC), allowing users with upload privileges to store JavaScript that executes in any visitor's browser as stored XSS. CISA SSVC reports no active exploitation. R...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

CVE-2026-76764

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

CVE-2026-76764 code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

EUVD-2026-63186

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

CVE-2026-76764

code-projects Employee Management System 1.0 is vulnerable to SQL injection via the mailuid argument in /process/aprocess.php (Admin Login Endpoint). CVSS 7.3 HIGH. Exploit proof-of-concept published; no patch version provided. Exploitation details not available in provided documents.

PT-2026-79269

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import filtering opts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and ...

PT-2026-79152

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

PT-2026-79058

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom field project attribute. The dialog path resolves the project custom field by its raw identifier without...

Grafana Labs 11.2.0 <= 11.6.16 / 12.2.0 <= 12.2.10 / 12.3.0 <= 12.3.8 / 12.4.0 <= 12.4.5 / 13.0.0 <= 13.0.3 / 13.1.0 < 13.1.1 Information Disclosure (CVE-2026-11817)

The version of Grafana Labs installed on the remote host is 11.2.x through 11.6.x prior or equal to 11.6.16, 12.2.x prior or equal to 12.2.10, 12.3.x prior or equal to 12.3.8, 12.4.x prior or equal to 12.4.5, 13.0.x prior or equal to 13.0.3, or 13.1.0. It is, therefore, affected by an information...

PT-2026-79039

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

PT-2026-79037

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. T...

PT-2026-79038

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view order.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released...

Mattermost Server 11.7.x < 11.7.7 / 11.8.x < 11.8.4 Incorrect Authorization (MMSA-2026-00718)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00718 advisory. - Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belong...

cve-2026-59271 - MEDIUM - Admin password disclosed in BrokerNotAliveException message

cve-2026-59271 - MEDIUM - Admin password disclosed in BrokerNotAliveException message...

CVE-2026-76404

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

CVE-2026-76346

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...

CVE-2026-76310

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-76404 Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...