CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

PT-2026-98822

Name of the Vulnerable Software and Affected Versions OpenStack Glance affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the Image API v2. When the show multiple locations configuration option is enabled in glance-api.conf, an authenticated attacker ca...

PT-2026-98994

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

PT-2026-98891

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description An authenticated administrator can store a crafted expression via the image order variable in the 'admin/element set ranks.php' endpoint because the application fails to enforce the sort-field...

PT-2026-99078

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An issue exists where attacker-controlled HTML in inbound emails or tickets can bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browse...

CVE-2026-19775: Missing Authorization

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-67413: Inefficient Regular Expression Complexity

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmqjmstopicexchange plugin's x-jms-topic exchange accepted a client-controlled rjmserlangselector binding expression whose LIKE evaluator expanded percent and underscore wildcards in...

Linux Distros Unpatched Vulnerability : CVE-2026-98113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request...

PT-2026-98977

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

EUVD-2025-211003

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

CVE-2026-51773

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

EUVD-2026-87085

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

PT-2026-99062

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description The software fails to enforce form fill-in restrictions on the authenticated submission endpoint "POST /user/form/data/create". Authenticated attackers with knowledge of a form's key can subm...

CVE-2026-88420

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput versions v1.2.1 through v2.2.0 . This flaw allows authenticated attackers possessing Wagtail Editor privileges to execute arbitrary code within a victim's browser by providing a crafted...

CVE-2026-51772

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance . When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a ...

Mattermost Server 10.11.x < 10.11.23 / 11.7.x < 11.7.8 / 11.8.x < 11.8.5 / 11.9.x < 11.9.1 Incorrect Authorization (MMSA-2026-00702)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00702 advisory. - Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to sanitize Team objects returned by the data retention team...

PT-2026-98957

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An authenticated attacker can silently remove temporary file uploads of another user before a ticket or article is submitted. This occurs because the destroy form action on the AttachmentsController...

PT-2026-99108

Name of the Vulnerable Software and Affected Versions RustDesk versions prior to 1.5.0 Description On Linux and macOS, the Cliprdr message handler fails to properly validate file transfer permissions for incoming file clipboard messages. This allows authenticated remote peers, even those with fil...

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

CVE-2025-51457

The D-Link DAP-2610 router, running firmware version up to 2.06B08r099 , is susceptible to an authenticated command injection vulnerability. This flaw exists within the web interface at the /index.xgi endpoint, where an attacker with valid credentials can exploit specific parameters to execute ar...