EUVD-2026-57687

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-ap...

PT-2026-71503

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

PT-2026-71700

Name of the Vulnerable Software and Affected Versions Email Management API affected versions not specified Description The Email Management API contains a flaw that allows the bypass of restrictions within the ManageCredentials feature. Recommendations At the moment, there is no information about...

PT-2026-71718

Name of the Vulnerable Software and Affected Versions Rainbond versions prior to 6.9.8 Description Broken access control exists in the CheckToken function. Authenticated attackers can access unauthorized enterprise resources by substituting another enterprise's tenant name within URL paths. By...

PT-2026-71887

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

PT-2026-71810

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPathoperation.key.setnewMetadata, value in...

PT-2026-71880

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

RockyLinux 10 : grafana (RLSA-2026:54178)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54178 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6...

VulnCheck KEV: CVE-2026-26190

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath...

PT-2026-71912

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

PT-2026-71434

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the '/api/block/getRefIDs' endpoint due to a failure to verify password-protected document tiers. This allows unauthenticated readers to identify that...

PT-2026-71754

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

PT-2026-71753

Name of the Vulnerable Software and Affected Versions Kibana Fleet affected versions not specified Description Improper privilege management in Kibana Fleet allows for privilege escalation. This occurs when an integration policy declares extra data streams for writing, which Fleet then adds to th...

PT-2026-71435

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists where the '/api/storage/getOutlineStorage' endpoint fails to perform authorization checks. This allows an attacker to retrieve the outline state, including headi...

PT-2026-71833

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.6 Description An issue exists in the platform for building and deploying managed AI agents and workflows. The endpoint "/api/v1/deployments/:deploymentId/background-workers" invokes the...

PT-2026-71689

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...

CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. When secureEnabled=true, FUXA 1.3.0-2773 still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue...

CVE-2026-47718

CVE-2026-47718 (FUXA) affects the FUXA web-based SCADA/HMI with secureEnabled=true. In version 1.3.0-2773 , the token handling in server/api/jwt-helper.js (verifyToken) converts missing or invalid tokens into a guest context instead of rejecting the request, allowing unauthenticated or invalid-to...

CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. When secureEnabled=true, FUXA 1.3.0-2773 still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue...

CVE-2026-47717 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue...