EUVD-2026-55979

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon previously constructed an HTML string directly from the icon value: Because the icon is user-supplied, a crafted value could break out of the intended...

CVE-2026-73159 cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon previously constructed an HTML string directly from the icon value: Because the icon is user-supplied, a crafted value could break out of the intended...

CVE-2026-73159 cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon previously constructed an HTML string directly from the icon value: Because the icon is user-supplied, a crafted value could break out of the intended...

CVE-2026-73159

CVE-2026-73159 affects certain versions of cti-transmute where a tag’s icon can be stored and later interpolated into HTML via Vue v-html. The root cause is user-supplied icon values that were used to build HTML strings like , enabling potential HTML injection when rendered in the viewer’s browse...

CVE-2026-73159 cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon previously constructed an HTML string directly from the icon value: Because the icon is user-supplied, a crafted value could break out of the intended...

WordPress Smart Admin Assistant – Dashboard and Site Enhancements plugin <= 2.2.0 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Smart Admin Assistant versions = 2.2.0...

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems CMS platform's plugins team to temporarily disable their downloads. "Unlike traditional software supply chain attacks, zero source code files wer...

[SECURITY] [DSA 6429-1] caddy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/security/ Aron Xu August 11, 2026 https://www.debian.org/security/faq -...

Myndr: Myndr CORS Misconfiguration

The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts...

CVE-2026-24329

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

CVE-2026-24329 Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

GHSA-5QJQ-93H5-HRGP vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-66772

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-66772 Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

EUVD-2026-55884

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-66772

CVE-2026-66772 concerns SAP BusinessObjects BI Platform (Admin Tools), where a missing authorization check on certain administrative functionality lets an authenticated non-administrative user bypass restrictions to glean limited information about the affected feature. The impact is described as ...

CVE-2026-66772 Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-11736: Improper Input Validation

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality...

CVE-2026-72562: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker wit...

CVE-2026-11734: Stack-based Buffer Overflow

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable...