CVE-2026-80183

OpenStack Keystone before 29.0.3 is vulnerable to a broken access control flaw in list_role_assignments_for_tree, caused by misuse of "None" in the policy domain_id check. Because a domain's project record stores domain_id=null, any authenticated user holding role:reader on any project can pass a...

CVE-2026-80183

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...

CVE-2026-62249

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2026-63179 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...

CVE-2026-54256

Winter CMS (v1.2.12 and earlier) contains an Insecure Direct Object Reference (IDOR) in the backend FileUpload form widget. The widget's getFileRecord() resolved a user-supplied file_id POST parameter against the global system_files table without scoping to the widget's own relation or parent rec...

CVE-2020-15876

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

CVE-2020-15878

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajaxtable.php API endpoint...

CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2026-80350 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-9668 SQL injection vulnerability in ZTE SCP product

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitati...

WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability

WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.2.0-4.0.6...

PT-2026-82314

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated reflected Cross-Site Scripting XSS issue exists in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a...

PT-2026-82096

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An issue exists where an authenticated user with developer-role permissions can influence the execution environmen...

PT-2026-82095

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.10 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 Description An authenticated user can cause a denial of service through an unbounded loop. This occurs when specially crafted input is...

PT-2026-82317

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...

CVE-2020-15876

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

EUVD-2026-65611

NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending crafted API requests. A successful exploit of this vulnerability may lead to code execution, escalation of privileges and...