PT-2026-107542

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-confluence-to-markdown versions prior to 0.3.25 Description Improper repository path validation in a scaffolder backend module allows an authenticated user who can execute an affected template and...

CVE-2026-104651: Authorization Bypass Through User-Controlled Key

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

CVE-2026-93443: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code...

PT-2026-107414

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including...

PT-2026-107753

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...

CVE-2026-97717: Uncontrolled Resource Consumption

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

PT-2026-107429

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the UR...

PT-2026-107533

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions prior to 1.14.8 @backstage/plugin-techdocs-node versions prior to 1.15.6 @backstage/plugin-techdocs-node versions prior to 2.0.1 Description The @backstage/plugin-techdocs-node package improperly...

PT-2026-107324

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description A remote authenticated attacker can obtain sensitive information due to the exposure of such data to unauthorized actors. Recommendations Update IBM Langflow OSS to a version later tha...

PT-2026-107400

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...

CVE-2026-97671: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

CVE-2026-106563: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes...

CVE-2026-87782: Improper Privilege Management

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...

PT-2026-107593

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

CVE-2026-97676: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape...

CVE-2026-104335: Improper Access Control

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control...

FreeBSD: VID-099d4998-33cc-11f1-a7d1-2cf05da270f3 (CVE-2026-1403): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-76437: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

PT-2026-107318

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper control of code generation allows a remote authenticated attacker to execute arbitrary code. Recommendations At the moment, there is no information about a newer version that...

PT-2026-107320

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Remote authenticated attackers can execute arbitrary code due to improper control over the generation of code. Recommendations Update IBM Langflow OSS to a version later than 1.12.2...