CVE-2026-68527

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-88061 career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

CVE-2026-88061

career-ops (an open-source AI-assisted job search tool) prior to 0.8.0 exposed its local web dashboard (web/) /api routes for command-spawning and user-file-writing without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could issue ...

CVE-2026-88061 career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

EUVD-2026-75678

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

CVE-2026-68527

Concrete CMS 8.3.0 through 9.5.2 contains an authorization bypass (cross-calendar IDOR) in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog validated permissions against the calendar identifier supplied in the request rather than the calendar actually owning...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to cross-site request forgery (CVE-2025-36422)

Summary A cross-site request forgery vulnerability was addressed in IBM InfoSphere Information Server. Vulnerability Details CVEID:CVE-2025-36422 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request...

CVE-2026-80183

A flaw was found in OpenStack Keystone. An authenticated user with a 'reader' role on any project can exploit a vulnerability in the /v3/roleassignments endpoint. By providing a domain ID with the 'includesubtree' parameter, the user can list all project-scoped role assignments across any domain...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88017

rclone versions 1.64.0 through 1.75.1 contain a cross-session authentication confusion in the FTP auth-proxy driver (cmd/serve/ftp/ftp.go). The server stores one obscured password per username in a global userPass map rather than binding it to the authenticated session. When a second login with t...

CVE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

EUVD-2026-75577

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88898

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...