CVE-2026-56829 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

ROS-20260915-73-0196

The vulnerability of the Serial component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...

PT-2026-93222

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A Reflected Cross-Site Scripting issue exists where an attacker can craft a malicious link. If a legitimate user interacts with this link, it may cause the user...

ROS-20260915-73-0201

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

PT-2026-92167

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...

ROS-20260915-73-0030

The vulnerability of the Actor component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260915-73-0133

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

EUVD-2026-78941

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

CVE-2026-75792

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...

CVE-2026-75792 IBM Sterling Secure Proxy is vulnerable to multiple issues

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...

EUVD-2026-78140

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...

CVE-2026-75792 IBM Sterling Secure Proxy is vulnerable to multiple issues

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...

CVE-2026-75792

IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 are affected by a client-side authorization bypass (CWE-285: Improper Authorization) that allows a remote authenticated attacker to view administrative user interface components . The vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM)...

CVE-2026-19543

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit...

svelte-poc

Svelte 5.57.0 - client-side XSS via spread attributes SvelteK...

EUVD-2026-77761

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit...

CVE-2026-19543 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit...

CVE-2026-19543

IBM Common Licensing Agent and IBM LKS Administration and Reporting Tool (ART) , versions 9.0, 9.0.0.1, and 9.0.0.2 , perform input validation exclusively on the client side without enforcing equivalent restrictions on the server side. An attacker with local access can modify requests to bypass v...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities CVE-2026-78415, CVE-2026-75792 affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-78415 DESCRIPTION: IBM Sterling Secure Proxy could allow a remote authenticated attacker to perform UI spoofin...