CVE-2026-89252

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...

CVE-2026-89253

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

CVE-2026-89246

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...

CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

EUVD-2026-76065

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

CVE-2026-89246

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is affected by a CSV formula injection vulnerability in the myComments.download.php endpoint. The root cause is a failure to sanitize spreadsheet formula prefixes (=, +, -, @) in comment text before CSV export. An authenticated...

CVE-2026-14566

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

CVE-2023-32749-PoC

CVE-2023-32749 | Pydio Cells Unauthorised Role Assignment Exploit for CVE-2023-32749 affecting Pydio Cells 4.1.2 and earlier. A low-privileged authenticated user can create a new external user with all roles assigned, granting access to all cells and non-personal workspaces across the instance...

EUVD-2026-75760

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system...

CVE-2026-79362

CVE-2026-79362 is a Remote Code Execution (RCE) vulnerability in Woltlab Suite Core (WCF) , affecting versions 6.1.0 through < 6.1.23 and 6.2.0 through

PT-2026-90510

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

Linux Distros Unpatched Vulnerability : CVE-2026-88031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file...

PT-2026-90523

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

EUVD-2026-75171

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value...

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Summary Calendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object ...

EUVD-2026-75172

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle...

CVE-2026-86087

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are affected by a vulnerability that allows an authenticated user to send a specially crafted request to write arbitrary files on the system. The CVSS v3.1 score is 4.3 (MEDIUM) with a network attack vector, low complexity, low priv...

CVE-2026-86087 IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system...

CVE-2026-9327

CVE-2026-9327 affects IBM WebSphere Application Server versions 9.0 (9.0.0.0–9.0.5.28) and 8.5 (8.5.0.0–8.5.5.30). The vulnerability is an improper privilege management flaw (CWE-269) that allows an authenticated user with a low-privilege administrative role to modify security configuration, pote...

CVE-2026-9327 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...