CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18852

A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual condition...

CVE-2026-18852: Improper Check for Unusual or Exceptional Conditions

A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual condition...

CVE-2026-7753: Missing Authorization

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

PT-2026-68467

Name of the Vulnerable Software and Affected Versions Accelerate versions prior to 1.5.4 Description The Accelerate theme for WordPress allows unauthorized modification of data because the enqueue scripts function lacks a proper capability check. This flaw enables authenticated users with...

PT-2026-68270

Name of the Vulnerable Software and Affected Versions Jenkins SCM-Manager Plugin versions prior to 1.11.2 Description A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL. By providing a specific URL and credentials IDs obtained...

PT-2026-68273

Name of the Vulnerable Software and Affected Versions Jenkins Parameterized Remote Trigger Plugin versions prior to 3.2.3 Description A missing permission check allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Recommendations Update...

CVE-2026-70435: Missing Authorization

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-4431: Missing Authorization

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

PT-2026-67965

Name of the Vulnerable Software and Affected Versions Dokan versions prior to 5.0.2 Description A privilege escalation issue exists due to a missing authorization check in the CustomersController REST controller located in includes/REST/CustomersController.php. The plugin re-registers WooCommerce...

CVE-2026-7105: Missing Authorization

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

PT-2026-68049

Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description MLflow AI Gateway fails to validate the auth config.api base value during the creation of a gateway secret in the create gateway secret function. This value is stored without verification of t...

CVE-2026-17583: Missing Support for Integrity Check

The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes...

CVE-2026-70436: Missing Authorization

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check 1.4.0 and earlier or performs an improper permission check 1.4.1 when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to...

CVE-2026-70444: Protection Mechanism Failure

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

PT-2026-68079

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd component where the ksmbd smb2 check message function reads the StructureSize2 field without verifying if the compound SMB2 request element is large enough t...

The vulnerability of the `check_unsafe_options()` function in the Python library for interacting with Git repositories, GitPython, allows a malicious actor to execute arbitrary code.

The vulnerability of the checkunsafeoptions function in the Python library for interacting with Git repositories, GitPython, is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...

CVE-2026-70433: Missing Authorization

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70446: Missing Authorization

Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

PT-2026-68279

Name of the Vulnerable Software and Affected Versions Jenkins Violation Comments to GitLab Plugin versions prior to 2.62.1 Description A missing permission check allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Recommendations Update...