CVE-2026-86105

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to...

CVE-2026-13224

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request...

CVE-2026-11895: Improper Neutralization of Input During Web Page Generation

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-86105: Improper Handling of Unicode Encoding

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to...

PT-2026-103471

Name of the Vulnerable Software and Affected Versions Tugtainer versions prior to 1.30.6 Description An authenticated user can trigger the backend server to send outbound HTTP requests to arbitrary user-supplied URLs. This occurs via the '/settings/test notification' endpoint, which accepts a url...

CVE-2026-102137: Unrestricted Upload of File with Dangerous Type

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...

CVE-2026-79625: Concurrent Execution using Shared Resource with Improper Synchronization

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...

PT-2026-103052

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-103088

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker can provide an improperly validated audience class name to the Report Builder component, leading to arbitrary class instantiation. This allows the unauthorized creati...

Iron Mountain enVision 260654 Authenticated SQL Injection

Iron Mountain enVision versions before 260655 contain an authenticated SQL injection vulnerability in the DocumentModule document-listing and detailed-search sorting parameter...

CVE-2026-103474: Unrestricted Upload of File with Dangerous Type

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-62308: Server-Side Request Forgery (SSRF)

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-100271: Missing Authorization

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects...

CVE-2026-100266: Missing Authorization

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address...

CVE-2026-102585: Placement of User into Incorrect Group

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

CVE-2026-102584: Direct Request

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessme...

CVE-2026-102580: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

CVE-2026-92872: Insertion of Sensitive Information into Log File

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information...

CVE-2026-92869: Out-of-bounds Write

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination...

CVE-2026-92867: Out-of-bounds Write

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution...