CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67351

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain...

CVE-2026-65635 Boruta dynamic client registration allows creation of over-privileged OAuth clients

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...

CVE-2026-65635

The CVE affects the boruta library (Elixir.Boruta.Openid) and its OpenID dynamic client registration path. The root cause is that Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlis...

EUVD-2026-51144

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...

CVE-2026-11707 Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page...

CVE-2026-11707

CVE-2026-11707 affects IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager 4.1. The issue is a cross-site scripting vulnerability in the administrative console login page. IBM bulletins for this family (CVE-2026-11594, CVE-2026-11707, CVE-2026-11383) documen...

EUVD-2026-51141

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page...

EUVD-2026-51140

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console...

EUVD-2026-51105

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are no...

WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.9.0 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Admin and Site Enhancements ASE Pro versions = 8.9.0...

EUVD-2026-51076

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

CVE-2026-15153

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-11867

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

CVE-2026-14239

CVE-2026-14239 concerns the TourMaster WordPress plugin prior to 5.4.8. The flaw stems from two issues: (1) no nonce check when storing a custom-filter label from a request parameter, and (2) failure to escape that label when echoed on the filter admin page. This enables an unauthenticated attack...

EUVD-2026-51014

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-11867 Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

CVE-2026-11867

The CVE concerns the Frontend Admin by DynamiApps WordPress plugin prior to version 3.29.7. The issue is missing capability checks on taxonomy term create/modify/delete operations, allowing authenticated, low-privilege users (e.g., Subscribers) to create, rename, and delete arbitrary taxonomy ter...

EUVD-2026-50996

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...