PT-2026-60720

The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting...

CVE-2026-10525: Improper Neutralization of Input During Web Page Generation

The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting...

CVE-2026-52348

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order method of CrudOption.java...

CVE-2026-52348: Improper Neutralization of Special Elements used in an SQL Command

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order method of CrudOption.java...

CVE-2026-21760: Direct Request

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality Forced Browsing vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints...

PT-2026-65341

Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie...

CVE-2026-62235: Missing Authorization

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

PT-2026-60801

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the admin REST API of Keycloak, an identity and access management solution. The issue occurs when a delegated administrator attempts to remove a child role from a composite...

PT-2026-60917

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.18.0 through 1.18.1 Description In the NamespacedMutatingPolicy CEL compiler, the generator library is exposed to matchConditions, allowing a namespace-scoped policy to invoke the generator.applynamespace, resources function...

PT-2026-60850

Name of the Vulnerable Software and Affected Versions django-pyas2 versions prior to 1.2.4 Description An OS command injection flaw exists where the cmd receive and cmd send fields on the Partner model are passed directly to the os.system function in pyas2/utils.py without proper sanitization. Th...

Hikvision HikCentral Professional has an unknown vulnerability (CNVD-2026-28554)

Hikvision HikCentral Professional is a professional edition of the AI Cloud-based application management platform designed for edge domains by Hikvision, a Chinese company. Hikvision HikCentral Professional has a security vulnerability that stems from access control issues. Attackers can exploit...

PT-2026-60645

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

CVE-2026-52348

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order method of CrudOption.java...

PT-2026-60853

Name of the Vulnerable Software and Affected Versions Xenforo version 2.3.8 Description A Server-Side Request Forgery SSRF issue exists where users with administrator privileges or the ability to add and save RSS feeds can enumerate internal services and ports or expose the server's original IP...

CVE-2026-42168

The django-pyas2 file transfer server (versions through 1.2.3 ) is vulnerable to OS command injection because the cmd_receive and cmd_send fields on the Partner model are passed directly to the os.system() function in pyas2/utils.py without proper sanitization. This flaw allows an authenticated a...

CVE-2026-52348

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order method of CrudOption.java...

PT-2026-60617

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient policy checks on configured input paths...

PT-2026-60643

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-52348

The software cool-admin-java version 8.0.0 is susceptible to a SQL injection vulnerability within the order() method of the CrudOption.java file. This flaw allows an attacker to execute malicious SQL statements to manipulate the web application's database server. No patched version is currently r...

CVE-2026-48010: Improper Privilege Management

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEMSCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission...