EUVD-2026-97328

A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...

CVE-2026-105409 Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...

CVE-2026-105409

A Stored Cross-site Scripting (XSS) vulnerability exists in Tuleap Enterprise Edition versions 17.0 through 17.5 . This flaw allows an attacker to execute arbitrary script code within a user's browser session. While the CVSS 3.1 score is 8.7 (High) , indicating high impact on confidentiality and ...

CVE-2026-105408

A Stored Cross-site Scripting (XSS) vulnerability exists in Tuleap Enterprise Edition versions 17.0 through 17.5 . This flaw allows an attacker to execute arbitrary script code within a user's browser session. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During ...

CVE-2026-105407 OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server...

EUVD-2026-97326

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server...

CVE-2026-105407

An OS Command Injection vulnerability (CWE-78) affects Tuleap Enterprise Edition versions 17.0 through 17.5 . This flaw could allow an attacker to execute arbitrary commands on the server. The vulnerability has a High base severity score of 8.8. Exploitation details and specific remediation steps...

Arbitrary Code Injection

Overview agno is an Agno: a lightweight library for building Multi-Agent Systems Affected versions of this package are vulnerable to Arbitrary Code Injection via the runpythoncode function in python.py of the PythonTools component, where the code argument is passed without sufficient validation,...

environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) CallHome component is affected by multiple vulnerabilities

Summary The CallHome component in IBM Cloud Pak for Data System 1.0 includes several open-source and third-party frameworks and packages as part of its management and diagnostic infrastructure. Multiple security vulnerabilities have been identified in underlying components, including Django, Go...

CVE-2026-98385

A flaw was found in the Linux kernel. A race condition when switching memory management contexts allows the process scheduler to access memory that has already been freed, leading to a use-after-free condition. A local attacker could exploit this vulnerability to cause a Denial of Service DoS by...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch releases of Callhome. Vulnerability Details CVEID:CVE-2026-11824 DESCRIPTION: SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search...

CVE-2026-48212

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

CVE-2026-48212

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

UBUNTU-CVE-2026-48212

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

CVE-2026-48212 Stored XSS in external pages

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

CVE-2025-47549

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlf...

CVE-2024-13869

CVE-2024-13869 Migration,Backup, Staging – WPvivid 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft...

CVE-2026-6815

CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 Path Traversal & Arbitrary File Write Authenticated This repository contains a Proof of Concept PoC exploit for CVE-2026-6815, an arbitrary file write and path traversal vulnerability in Casdoor. The vulnerability has been fixed in version 3.54.1...

CVE-2026-87690

The Metasploit Framework post module post/appleios/gather/iosimagegather is affected by a relative path traversal vulnerability CWE-22. The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the loc...