CVE-2026-82266: Missing Authentication for Critical Function

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...

CVE-2026-55485: Exposure of Sensitive Information to an Unauthorized Actor

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

CVE-2026-39070

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

PT-2026-83243

Name of the Vulnerable Software and Affected Versions Piccolo Admin versions prior to 1.14.0 Description Piccolo Admin contains an authorization bypass and sensitive information leak. The superuser validators function in piccolo admin/endpoints.py uses a deny-list that blocks PUT, PATCH, DELETE,...

PT-2026-83289

Name of the Vulnerable Software and Affected Versions Redpanda versions prior to 26.2.3 Description The Admin API binds to '0.0.0.0:9644' with the admin api require auth variable defaulting to false. This configuration causes the system to treat unauthenticated requests as superusers, allowing...

PT-2026-83210

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-38725

The xipblog module v2.0.1 and before for PrestaShop is vulnerable to Stored Cross-Site Scripting (XSS) . Unauthenticated remote attackers can inject arbitrary JavaScript by providing malicious data via the name and content parameters in ajax.php . Because the input is stored in the database witho...

CVE-2026-38725: Improper Neutralization of Input During Web Page Generation

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

CVE-2026-39070: Improper Neutralization of Input During Web Page Generation

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

CVE-2026-39070

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

WS-2026-0035

MeshCentral stores the agent-supplied osdesc OS description field from the coreinfo message with no HTML sanitization, and renders it into the admin device details panel via innerHTML. A rogue or compromised MeshAgent can therefore inject arbitrary HTML and JavaScript that executes in the browser...

CVE-2026-39070

The Bit Assist WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in its Call-To-Action feature. This flaw affects versions 1.7.1 and lower , where an authenticated attacker with administrator privileges can insert a malicious payload into a widget's Call-To-Action form field. On...

EUVD-2026-67902

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

PT-2026-83096

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...

CVE-2026-78103 Dimension Log Server Configuration Lock Bypass Vulnerability

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

CVE-2026-78103

WatchGuard Dimension (Log Server) is affected by a configuration lock bypass in its server-side configuration endpoint. The product provides a client-side lock/unlock UI control for management changes, but the server-side endpoint does not enforce this workflow state. As a result, an authenticate...

CVE-2026-78195

CVE-2026-78195 was rejected as a duplicate of CVE-2026-78047. The underlying vulnerability is a Cross-Site Scripting (XSS) flaw in the WatchGuard Dimension Backup Historical Data feature, which allows an authenticated administrator to execute arbitrary JavaScript in another user's browser. No spe...

CVE-2026-78616

A Stored XSS vulnerability in WatchGuard Dimension 's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate. The CVSS 4.0 score is 4.8 (MEDIUM) , ref...

CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...