CVE-2026-70547

An authenticated user without repository read permission may access package metadata under specific conditions...

CVE-2026-68758

A low-privileged authenticated user may access restricted support information under specific conditions...

CVE-2026-59242

Apache Airflow versions prior to 3.3.1 are vulnerable to a deserialization of untrusted data (CWE-502) flaw. The GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint passes string-literal payloads through BaseXCom.deserialize_value without the _check_forbidden_xcom_keys guard. This allow...

EUVD-2026-57263

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-65938 WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-65938 WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-65938

WhatsUp Gold is affected in versions released before 2026.0.2 by an improper authorization vulnerability in the Scheduled Reports API that lets any authenticated user invoke restricted actions. The issue is documented across CVE-2026-65938 entries (NVD, CVE List) and is addressed in the 26.0.2 re...

CVE-2026-65938

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-70547

An authenticated user without repository read permission may access package metadata under specific conditions...

EUVD-2026-57260

An authenticated user without repository read permission may access package metadata under specific conditions...

CVE-2026-66382

An authenticated user may write files outside the intended Artifactory work directory under specific conditions...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the document.title assignment in JavaScript, where user-supplied GET parameters are...

CVE-2026-66384

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

EUVD-2026-57255

A low-privileged authenticated user may access restricted support information under specific conditions...

CVE-2026-68758

Technical details about CVE-2026-68758 are not publicly available in the provided documents; no affected products, versions, root cause, or remediation are specified. Monitor for updates.

EUVD-2026-57248

An authenticated user may view private Puppet module metadata without repository read access...

CVE-2026-66378 Authenticated users may access private NuGet metadata

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

CVE-2026-66380

CVE-2026-66380 describes a access control bypass where an authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. The public metrics indicate CVSS 3.1 base score 4.3 (Medium), with attack vector NETWORK and privileges required LOW,...

EUVD-2026-57244

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...

GHSA-M7JC-G4RC-JMVH Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Impact The Backend Filter widget Backend\Widgets\Filter is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via...