CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-85981 Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

CVE-2026-85981

The Auth0 AD/LDAP Connector (versions 6.5.0 and earlier ) has an unauthenticated administrative panel that listens on the local loopback interface without requiring credentials. A local, low-privileged user or process on the host can access the panel's management endpoints to read configuration d...

EUVD-2026-74185

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

CVE-2026-86464

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager IdM deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed the Keycloak service and its PostgreSQL...

CVE-2026-86731

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

Server-side Request Forgery (SSRF)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ExternalUrl validation process. An attacker can access internal services or cloud metadata endpoints by configuring webhook URLs with...

Incorrect Calculation

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Calculation via the checkout request process. An attacker can manipulate the assets.requestscounter by repeatedly submitting duplicate checkout requests or calling...

CVE-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

CVE-2026-86135

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...

CVE-2026-79576

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

CVE-2026-61516

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

CVE-2026-86735 snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

CVE-2026-86735 snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

CVE-2026-86735

snipe-it versions before 8.7.0 contain a server-side request forgery (SSRF) vulnerability in the ExternalUrl validation rule , which fails to detect IPv6 transition addresses (NAT64, 6to4, or Teredo) that encode private IPv4 targets. An attacker with super-admin privileges can configure webhook U...

CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

CVE-2026-86731

Craft CMS versions 5.0.0-RC1 through 5.10.11 contain a permission escalation flaw in UsersController::actionActivateUser (the users/activate-user action). The action requires the administrateUsers permission but fails to call requireAdmin() when the targeted user is an administrator, unlike the s...

CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...