PT-2026-80320

Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the panel admins.ip column via the Admins.add or Admins.update endpoint. The payload executes as a UNION-based SQL injection the next time...

PT-2026-76913

Name of the Vulnerable Software and Affected Versions Bastillion affected versions not specified Description Bastillion fails to properly validate request URI paths in its controller dispatcher. This allows unauthenticated attackers to bypass authentication filters by prefixing requests with...

SureForms 2.1.2 CSV Injection

SureForms version 2.1.2 and below contains an unauthenticated CSV injection vulnerability. A remote attacker can submit a specially crafted form field containing an encoded spreadsheet formula that is subsequently included in exported CSV data. When an administrator exports the submissions and...

PT-2026-80466

Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...

PT-2026-77518

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0.0 Description An issue in the Pod Admin component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-78230

Name of the Vulnerable Software and Affected Versions Tapo C200 version v5 Description An improper authentication issue exists within the login authentication verification module. An attacker on the local network can exploit weaknesses in the validation of the challenge parameter to bypass...

PT-2026-77180

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-45129: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-66638: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-45128: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

CVE-2026-45126: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-61302: Improper Access Control

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Pod Admin. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2026-45127: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

PT-2026-76932

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

PT-2026-77182

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

PT-2026-77267

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback messagemessage is stored without sanitization and rendered in app/views/admin/feedback messages/ feedback message.html.erb throu...

CVE-2026-19670: Incorrect Authorization

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

PT-2026-77144

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the governance-policy-addon-controller component allows a user with permissions to annotate the namespaced ManagedClusterAddOn resource to...

PT-2026-77078

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

PT-2026-77299

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...