CVE-2026-64870

CVE-2026-64870 affects MaxKB: UpdateStoreTool in versions 2.0.0–2.10.4-lts. The tool passes caller-supplied download_url and download_callback_url to requests.get without host/trusted-host and redirect validation, enabling an authenticated workspace user to trigger server requests to internal, lo...

CVE-2026-64870 MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...

SUSE CVE-2026-52805

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery SSRF vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated...

SUSE CVE-2026-54097

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser with create + delete permissions in their own isolated scope can silently destroy share-link...

SUSE CVE-2026-55668

File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create...

CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

CVE-2026-57862

CVE-2026-57862 affects Kanboard 1.2.52 and earlier. The SSRF bypass arises when authenticated users submit hexadecimal-encoded IPs via user-controlled URLs, causing cURL to resolve internal resources. The isPrivateURL() filter in app/Core/Http/Client.php is considered safe due to FILTER_VALIDATE_...

CVE-2026-57862 Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link...

CVE-2025-36431

IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.01 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2025-36431

CVE-2025-36431 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.2.0 through 6.2.2.0_1). The issue is a cross-site scripting vulnerability in the web UI that lets an authenticated user embed arbitrary JavaScript, potentially leading to credentials disclosure in a tru...

CVE-2025-36298

IBM Sterling B2B Integrator and IBM Sterling File Gateway Ebics server components are vulnerable to cross-site scripting (CWE-79). Affected versions include B2Bi and File Gateway 6.1.2.0–6.1.2.7_2, 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, and 6.2.2.0–6.2.2.0_1. The vulnerability allows an authentica...

CVE-2025-36298 Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway

IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 Ebics server component is...

CVE-2026-22622

Summary: CVE-2026-22622 affects Eaton’s Tripp Lite series PADM firmware. An authenticated user can exploit improper input validation in a session management interface to elevate privileges, potentially gaining unrestricted device access. The CVSSv3.1 base score is 8.8 (HIGH) with network attack v...

CVE-2026-22622

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device...

CVE-2026-15252

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

EUVD-2026-50998

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

CVE-2026-15235 Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...

CVE-2026-15235

The MotoPress Hotel Booking WordPress plugin prior to version 6.0.4 is affected by an access-control issue in an AJAX action: it does not perform a capability check when returning a booking’s full customer details. Any authenticated user with a low-privileged role (Subscriber and above) can read ...

CVE-2026-18186 A stored format string vulnerability was found in the FTP Backup on the ADM

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to...

MongoDB 8.3.x < 8.3.7 Aggregation Framework Memory Exhaustion (SERVER-128584)

The version of MongoDB installed on the remote host is 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation...