EUVD-2026-125356

In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist...

CVE-2026-128044

OpenMage magento-lts versions prior to 20.18.2 and 21.x before 21.0.0-beta3 are vulnerable to an OAuth Callback URL Allowlist Bypass (CWE-346). The software uses a string-prefix check to validate OAuth 1.0a oauth_callback URLs but incorrectly falls back to accepting any well-formed URL. An attack...

CVE-2026-123670 Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning

The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with...

CVE-2026-123670

The Essential Real Estate WordPress plugin, in versions prior to 5.3.6 , is vulnerable to an email relay allowlist poisoning flaw. The software fails to verify the legitimacy of recipients for its contact email action. This allows users with the self-registered Customer role to add arbitrary addr...

WordPress Essential Real Estate plugin 5.3.5-5.3.5 - Customer+ Email Relay Allowlist Poisoning vulnerability

Customer+ Email Relay Allowlist Poisoning vulnerability discovered by Aabideen Bangash in WordPress Plugin Essential Real Estate versions 5.3.5-5.3.5...

EUVD-2026-124846

The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with...

sanitize

Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

netfence

Netfence Like Envoy xDS, but for eBPF filters. Netfence runs as a daemon on your VM/container hosts and automatically injects eBPF filter programs into cgroups and network interfaces, with a built-in DNS server that resolves allowed domains and populates the IP allowlist. Netfence daemons can be...

CVE-2026-106472

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

CVE-2026-106472 Server-side request forgery in the Prometheus data source resource API

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

EUVD-2026-124571

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

CVE-2026-27876

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write to RCE CVSS 9.1 Critical | Arbitrary File Write | Remote Code Execution Demo https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Summary Grafana's SQL Expressions feature sqlExpressions toggle uses an...

sudowp-postgallery

SudoWP PostGallery Security Fork Contributors: SudoWP, WP Republic Original Authors: RTO GmbH Tags: gallery, security, patched, cve-2025-13543 Requires at least: 5.8 Tested up to: 6.7 Stable tag: 1.12.6 License: GPLv2 or later Security Notice This is a security-hardened fork of the abandoned...

PT-2026-145891

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

UBUNTU-CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-106472: Grafana: Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server…

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...

CVE-2026-65957

The Helio MCP proxy (prior to version 0.8.0 ) contains a CORS origin validation error in its dashboard sideband (defaulting to 127.0.0.1:3100). The software incorrectly validated request origins by matching hostnames against private-network string prefixes (e.g., 10., 172.16.-172.31., 192.168.) i...

CVE-2026-65957 Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...