CVE-2026-76564: Improper Neutralization of Input During Web Page Generation

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

PT-2026-80213

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in api fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api fields on the base page model title, slug, s...

PT-2026-79016

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-76997: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=savecategory. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

PT-2026-79269

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import filtering opts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and ...

PT-2026-80770

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2 Description The internal Pages admin API returns page fields declared in api fields without sufficient access...

CVE-2026-76998: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=deletecategory. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack...

CVE-2025-52182

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

PT-2026-79516

Name of the Vulnerable Software and Affected Versions WP Social Media Login versions prior to 1.0.7 Description The WP Social Media Login WordPress plugin fails to verify if a social login process was successfully completed with the identity provider before authenticating a visitor. This allows...

CVE-2026-77648: Server-Side Request Forgery (SSRF)

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

CVE-2026-19615: Improper Neutralization of Input During Web Page Generation

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

PT-2026-79039

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

PT-2026-78899

Name of the Vulnerable Software and Affected Versions vsDesk versions prior to 14.0101 Description An OS command injection flaw exists due to insufficient input filtering. This allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands, which...

Mattermost Server 11.7.x < 11.7.7 / 11.8.x < 11.8.4 Incorrect Authorization (MMSA-2026-00718)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00718 advisory. - Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belong...

PT-2026-79058

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom field project attribute. The dialog path resolves the project custom field by its raw identifier without...

PT-2026-79037

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. T...

CVE-2026-76404

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

CVE-2026-76346

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...

CVE-2026-76310

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-76404

The Splunk MCP Server app deserializes stored credential data without type validation, allowing an admin-role user to trigger arbitrary OS command execution. Affected versions are below 1.2.1; no exploitation evidence is provided. Update to version 1.2.1 to remediate. Splunk advisory: https://adv...