CVE-2026-86419: Server-Side Request Forgery (SSRF)

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused acro...

CVE-2026-86264: Improper Neutralization of Input During Web Page Generation

A flaw has been found in sfturing ssmpro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName...

PT-2026-86678

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument site name/site desc leads to cross site scripting...

The vulnerability of the Portal component of the Kubernetes Helm package manager allows a attacker to perform cross-site scripting attacks.

The vulnerability of the Portal component of the Kubernetes Helm package management tool is related to the lack of security measures for protecting the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

MiracleLinux 9 : grafana-10.2.6-23.el9_8.3 (AXSA:2026-1777:26)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1777:26 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service...

CVE-2026-86226

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

CVE-2026-86226 Projectwolds Online Attendance System profile.php cross site scripting

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

CVE-2026-86226

Projectwolds Online Attendance System 1.0 contains a cross-site scripting (XSS) vulnerability in the file profile.php , triggered by manipulation of the email argument. The flaw allows a remote attacker with low privileges to inject scripts if a user interacts with the crafted request. The CVSS 3...

CVE-2026-86226 Projectwolds Online Attendance System profile.php cross site scripting

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99777 CVE-2026-19931 affecting package cmake 3.30.3-15

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99752 CVE-2026-19931 affecting package curl 8.11.1-11

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CVE-2026-86216

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-86216

CVE-2026-86216 affects the code-projects Hotel and Tourism Reservation in PHP 1.0 application. A reflected cross-site scripting (XSS) vulnerability exists in the file /ht/details.php , where the room parameter is not properly sanitized. The vulnerability is exploitable remotely with no authentica...

CVE-2026-86216 code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-86216 code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-86254 wger Incomplete Authorization Fix Cross-Tenant Account Deletion

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

CVE-2026-86254 wger Incomplete Authorization Fix Cross-Tenant Account Deletion

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

CVE-2026-86254

wger (gym management platform) contains an incomplete authorization bypass in wger/core/views/user.py. Three views retain a raw integer comparison for the gym-scope check instead of the is_same_gym() helper, creating a None != None edge case . An attacker with gym.manage_gym permission and a gym=...

CVE-2026-86181

A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be...