CVE-2026-102094

The Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection . The vulnerability exists because the mail-processing pipeline fails to sufficiently restrict code loaded from an imported rule configuration . An authenticated administrator with mail-rule configurati...

CVE-2026-102093 Kiteworks Core improper privilege management

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full...

CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103474

The yii2-starter-kit software, through version 4.2.0 , contains an Unrestricted File Upload vulnerability in the backend storage upload actions. The root cause is a failure to validate file types, which allows authenticated users with the manager role to upload PHP files . An attacker can leverag...

EUVD-2026-90205

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-62308

Prior to version 1.30.6 , Tugtainer (a self-hosted app for automating Docker container updates) is vulnerable to an authenticated blind server-side request forgery (SSRF) . The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocol...

EUVD-2026-90083

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-100271

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects...

CVE-2026-100266

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address...

CVE-2026-100271

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects...

CVE-2026-100271

In JetBrains YouTrack versions prior to 2026.2.19197 , a missing authorization vulnerability on several endpoints allows authenticated users to access information from projects they are not authorized to view. The vulnerability results in a LOW confidentiality impact. No specific exploit details ...

CVE-2026-100266

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address...

EUVD-2026-90010

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address...

CVE-2026-100266

In JetBrains Hub versions prior to 2026.2.52366 , a missing authorization vulnerability allows authenticated users to send arbitrary emails from the server's trusted address. This flaw impacts the integrity of communications sent via the hub. Remediation is available in version 2026.2.52366 or la...

SUSE CVE-2026-102830

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-13719

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface API to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is...

CVE-2026-93547

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

USN-8854-1: OpenStack Keystone vulnerabilities

Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. CVE-2026-80182 It was discovered that...

Malicious code in @bellaxchuu/teambails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses perl 0:5.32.1-481.1.el96, GO-2026-6061- go - google.golang.org/grpc/internal/transport :v1.82.0, nodejs - tar:7.5.19, bind 32:9.16.23-40.el98.2, cryptography 46.0.7, libarchive 3.5.3-9.el97 which is vulnerable to CVE-2023-47038,...