CVE-2026-91133: Improper Neutralization of Special Elements in Data Query Logic

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

PT-2026-97709

Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions prior to 3.4.2 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if the authenticated user requesting course-progress records is the actual owner of those records. This allows...

PT-2026-98142

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description An issue exists in the StopWords::add function where user-supplied input is inserted into a SQL INSERT statement using sprintf without proper database escaping. This occurs specifically in the code...

PT-2026-98238

Name of the Vulnerable Software and Affected Versions Docmost versions 0.70.0 through 0.80.0 Description An authenticated user with low privileges who can edit an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the page is exported using...

PT-2026-98037

Name of the Vulnerable Software and Affected Versions MongoDB integration for Laravel affected versions not specified Description Improper neutralization of special elements in the data query logic within the cache lock implementation allows a caller-supplied lock owner value to be evaluated as a...

PT-2026-98143

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description A user with the customfields.create permission can store malicious markup in the CustomField.name variable. The app/Presenters/AssetPresenter.php file assigns this value as an unescaped...

PT-2026-98281

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware contains an out of bounds write issue within its command processing functionality. An authenticated attacker with adjacent network access can submit crafted command data to...

CVE-2026-79766: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

Linux Distros Unpatched Vulnerability : CVE-2026-66072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw...

CVE-2026-82850: Exposure of Sensitive Information to an Unauthorized Actor

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

Linux Distros Unpatched Vulnerability : CVE-2026-67238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binar...

Linux Distros Unpatched Vulnerability : CVE-2026-66070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed...

PT-2026-97846

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can perform directory traversal on the system. This occurs because the software fails to properly limit pathnames to a restricted directory, allowi...

PT-2026-97842

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

CVE-2026-48073: Authorization Bypass Through User-Controlled Key

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

PT-2026-98239

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1 Description An authenticated workspace member who is not a member of a private space can access confidential content and source page metadata. This occurs because the transclusion / sync-block lookup API does n...

PT-2026-97862

Name of the Vulnerable Software and Affected Versions Termix versions 2.5.0 through 2.5.0 Description Authenticated users can configure webhook or ntfy notification channels using destination URLs controlled by an attacker. By using the notification-channel test endpoint, an attacker can trigger...

PT-2026-98459

Name of the Vulnerable Software and Affected Versions OpenStack Swift affected versions not specified Description An issue exists in the s3api middleware where truncated aws-chunked PUT request bodies are handled incorrectly. An authenticated attacker can exploit this behavior to cause the system...

CVE-2026-77294: Server-Side Request Forgery (SSRF)

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

PT-2026-97841

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A path traversal issue allows a remote authenticated attacker to execute arbitrary commands. Path traversal is a flaw that allows an attacker to access files and directories that...