EUVD-2026-66276

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-80214

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

CVE-2026-80198

Kimai versions before 2.56.0 fail to restrict the config Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind...

Command Injection

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Command Injection in the Virtualization Discovery process. An attacker can execute arbitrary commands on the host...

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-80214

LibreNMS 's Virtualization Discovery module is susceptible to command line injection , allowing an authenticated admin user to execute arbitrary code on the host server. The CVSS 4.0 base score is 8.6 (HIGH) , reflecting network reachability with low attack complexity but requiring high privilege...

CVE-2026-80214 LibreNMS Virtualisation Discovery Module RCE

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

EUVD-2026-66227

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

CVE-2026-80214 LibreNMS Virtualisation Discovery Module RCE

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104561)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104561 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink...

CVE-2026-81203: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-80214: Improper Neutralization of Special Elements used in an OS Command

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093203)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093203 advisory. In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: obs-server (UTSA-2026-093681)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093681 advisory. A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain...

PT-2026-81955

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-54553: Exposure of Sensitive Information to an Unauthorized Actor

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

PT-2026-82109

Name of the Vulnerable Software and Affected Versions Starlette-Admin versions prior to 0.16.1 Description An authenticated user with access to a list endpoint can bypass administrative interface restrictions by submitting arbitrary field names to the starlette admin/base.py and BaseModelView...

PT-2026-81923

Name of the Vulnerable Software and Affected Versions LibreNMS affected versions not specified Description The Virtualization Discovery module contains a command line injection flaw. This allows an authenticated administrator to execute arbitrary code on the host server. Recommendations At the...

PT-2026-82047

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Broken access control allows a user with organization administrator permissions to delete dashboard snapshots belonging to other organizations hosted on the same instance. Additionally, an...

PT-2026-82077

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.18 Description The getgrav/grav-plugin-api plugin fails to enforce API-key scope within the requireNotSuperTarget function located in UsersController.php across seven sensitive user-management...