EUVD-2026-62266

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-55984

A flaw was found in Gitea. An authenticated attacker could exploit a null pointer dereference within the AddTime API. This can lead to a denial of service DoS, making the application unavailable to legitimate users...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: celeborn, pinot, thingsboard, pinot-fips, seata, management-api-for-apache-cassandra-5.0, hadoop-fips, management-api-for-apache-cassandra-4.1, trino, management-api-for-apache-cassandra-4.0, tinkerpop, tez, apache-hop-fips...

CVE-2026-59902 vulnerabilities

Vulnerabilities for packages: celeborn, pinot, thingsboard, pinot-fips, seata, management-api-for-apache-cassandra-5.0, hadoop-fips, management-api-for-apache-cassandra-4.1, trino, management-api-for-apache-cassandra-4.0, tinkerpop, tez, apache-hop-fips...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, celeborn, tez, thingsboard, trino...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: infinispan, spark, wildfly, neo4j, tez, thingsboard, druid, zipkin, apache-activemq-artemis, keycloak, kserve-modelmesh, trino, opensearch, management-api-for-apache-cassandra-5.0, celeborn, logstash, apache-pulsar, strimzi-kafka-operator, wavefront-proxy, flyway,...

PT-2026-78732

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with a role possessing the rest properties get...

PT-2026-78782

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description An unauthenticated user can retrieve information from Edge Processor pipeline configurations when the Edge Processor is enabled. This occurs because the Edge Processor service REST API...

PT-2026-78781

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can compromise system...

CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users...

CVE-2026-74954

Information disclosure due to side-channel in the Storage: Cache API c...

CVE-2026-75874

Sandbox escape in the Remote Settings Client component. This vulnerabi...

UBUNTU-CVE-2026-74954

Information disclosure due to side-channel in the Storage: Cache API c...

PT-2026-78504

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions 4.0.0 through 4.14.4 Description A low-privilege read-only API user with manager:read permission can retrieve the cluster key from the ossec.conf element via the 'GET /manager/configuration?raw=true' endpoint. An attacke...

PT-2026-78393

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient enforcement of the CONFIGURATION EDIT permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session...

PT-2026-78391

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description Failure to validate the security.enableRegistration setting in API endpoints allows the creation of user accounts even when registration is disabled. This bypasses the restriction enforced on the HT...

EUVD-2026-62482

An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the apivedo/chat endpoint and the utentechat parameter...

UBUNTU-CVE-2026-74959

Mitigation bypass in the Storage: Cache API component. This vulnerabil...

UBUNTU-CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users...

Linux Distros Unpatched Vulnerability : CVE-2026-74954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154,...