CVE-2026-84860: Authorization Bypass Through User-Controlled Key

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...

CVE-2026-59823: Server-Side Request Forgery (SSRF)

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place apibase inside the userconfig request body to bypass isrequestbodysafe, which blocks top-level apibase and baseurl but...

PT-2026-93275

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

PT-2026-94013

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-93330

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where improper validation of group URL slugs during namespace transfers could allow an...

PT-2026-94072

Name of the Vulnerable Software and Affected Versions Coze Studio versions prior to 0.5.2 Description Authenticated users can exploit a lack of restriction on the server URL provided during the registration of plugin tools. This allows the backend to fetch internal services, enabling attackers to...

PT-2026-93971

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

PT-2026-93710

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242IEIMS version V1.06.01 Description The web management interface contains an OS Command Injection flaw, which occurs when an application fails to properly neutralize special elements used in an OS command. This allows a remote...

CVE-2026-92593: Improper Control of Generation of Code

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

Linux Distros Unpatched Vulnerability : CVE-2026-44202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user t...

SUSE CVE-2026-89707

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

CVE-2026-76863

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the modqosbandwidth plan.json handling within filterconnsdumpcgi.c and IGDCgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their...

CVE-2026-76863 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the modqosbandwidth plan.json handling within filterconnsdumpcgi.c and IGDCgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their...

CVE-2026-76863

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling, specifically within filter_conns_dump_cgi.c and IGD_CgiCall.c. Authenticated users with broad roles can access QoS read routes to obtain live network telemetry...

CVE-2026-92234

QloApps versions through 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the Hotel Reservation System feature management page (back-office). The child_features parameter is reflected unescaped into validation error messages, allowing an authenticated back-office user who fol...

CVE-2026-76705

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-76704

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access...

CVE-2026-76702

A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause a denial-of-service. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

CVE-2026-76691

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-76690

A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected component. Successful exploitation could...