CVE-2026-71880

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

EUVD-2026-61077

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...

CVE-2026-74046

Wazuh 4.4.0 through 4.14.6 is affected by a denial-of-service flaw in the fdecompress_files() function of cluster.py. The function decompresses synchronization archives without enforcing any decompressed size limit, so an attacker holding a valid cluster Fernet key can upload a small zip-bomb arc...

CVE-2026-74046 Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...

EUVD-2026-61075

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

CVE-2026-23938

Zabbix Server versions 6.0.x (prior to 6.0.47), 7.0.x (prior to 7.0.27), and 7.4.x (prior to 7.4.11) are vulnerable to a Denial of Service (DoS) attack. An authenticated administrator can crash the Zabbix server or proxy by creating specifically crafted JavaScript scripts within preprocessing or ...

PT-2026-78250

Name of the Vulnerable Software and Affected Versions PPWP: Password Protect Pages, Posts & Full or Partial Content versions prior to 1.9.16 Description An improper capability check in the can access function allows authenticated attackers with Contributor-level access or higher to retrieve a...

PT-2026-77337

Name of the Vulnerable Software and Affected Versions Koha versions prior to 26.05.02 Koha versions prior to 25.11.07 Koha versions prior to 25.05.13 Description A stored cross-site scripting issue exists in the purchase suggestion handler. Authenticated staff users can inject malicious scripts b...

PT-2026-77250

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow run as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run as endpoint. Attackers can...

CVE-2025-9210: Improper Verification of Cryptographic Signature

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

CVE-2026-74039: Allocation of Resources Without Limits or Throttling

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

CVE-2026-71880: Improper Neutralization of Special Elements Used in a Template Engine

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

Missing Authorization

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Missing Authorization via the CreateModelVersion endpoint, which...

Security Bulletin: IBM i is Affected By Denial of Service in Host Servers [CVE-2026-17015]

Summary IBM i is vulnerable to a denial of service due to an out-of-bounds read CVE-2026-17015 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17015 DESCRIPTION: IBM i could allow a remote authenticated attacker to cause a denial of service and obtain...

CVE-2026-16047

Mattermost versions 11.7.x ≤ 11.7.6, 10.11.x ≤ 10.11.21, and 11.8.x ≤ 11.8.3 contain an authorization flaw in the board-to-channel linking functionality. The server fails to verify that the requesting user has read access to a target channel before associating a board with it. An authenticated us...

CVE-2026-16139 Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution

In Progress ShareFile Storage Zones Controller versions = 5.12.5 and = 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote...

CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-74845

CVE-2026-74845 concerns the Official Document Management System by 2100 Technology, with an Arbitrary File Upload vulnerability that enables authenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server. From the connected references, ...

CVE-2026-15623

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...