CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

CVE-2026-26460

CVE-2026-26460 describes an HTML Injection vulnerability in the Dashboard module of Vtiger CRM 8.4.0 . The issue arises because user input in the tabid parameter of the DashBoardTab view (getTabContents action) is not properly neutralized, allowing an attacker to inject arbitrary HTML that gets r...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: cilium, cloud-provider-aws, gitlab-kas, gitaly, prometheus, kaf, kubescape, fuse-overlayfs-snapshotter, newrelic-fluent-bit-output, telegraf, chezmoi, prometheus-operator, karpenter, cilium-cli, kube-fluentd-operator, dask-gateway, falco-no-driver, nerdctl,...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: cilium, cloud-provider-aws, gitlab-kas, gitaly, prometheus, kaf, kubescape, fuse-overlayfs-snapshotter, newrelic-fluent-bit-output, telegraf, chezmoi, prometheus-operator, karpenter, cilium-cli, kube-fluentd-operator, dask-gateway, falco-no-driver, nerdctl,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: cilium, emissary, nri-discovery-kubernetes, azure-workload-identity-webhook, prometheus, amass, prometheus-adapter, lazygit, pvc-autoresizer, aws-flb-firehose, ipfs-cluster, crossplane, rancher-telemetry, ghaudit, kuberlr, snyk-cli, mongodb-kubernetes-operator,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: cilium, spiffe-helper, grafana, cloud-provider-aws, emissary, kubernetes-csi-driver-nfs, lazydocker, crossplane-provider-azure-managedidentity, kube-vip, opentelemetry-operator, prometheus, tetragon, otel-cli, keda, sftpgo-plugin-auth, aws-efs-csi-driver,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: cilium, spiffe-helper, grafana, cloud-provider-aws, emissary, kubernetes-csi-driver-nfs, lazydocker, crossplane-provider-azure-managedidentity, kube-vip, opentelemetry-operator, prometheus, tetragon, otel-cli, keda, sftpgo-plugin-auth, aws-efs-csi-driver,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: cilium, emissary, nri-discovery-kubernetes, azure-workload-identity-webhook, prometheus, amass, prometheus-adapter, lazygit, pvc-autoresizer, aws-flb-firehose, ipfs-cluster, crossplane, rancher-telemetry, ghaudit, kuberlr, snyk-cli, mongodb-kubernetes-operator,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: gh, github-mcp-server, hubble, oras-fips, k8s-metacollector-fips, karpenter, flux-source-controller, temporal, flux-image-reflector-controller, volume-modifier-for-k8s-fips, aws-network-policy-agent, listmonk, victoriametrics-cluster, karpenter-fips,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: gh, github-mcp-server, hubble, oras-fips, k8s-metacollector-fips, karpenter, flux-source-controller, temporal, flux-image-reflector-controller, volume-modifier-for-k8s-fips, aws-network-policy-agent, listmonk, victoriametrics-cluster, karpenter-fips,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: blob-csi, cloudflared-fips, k8s-metacollector-fips, temporal-ui-server-fips, crossplane-provider-aws-ec2-fips, crossplane-provider-aws-cognitoidp-fips, virt-api, fleet-server, rke2-runtime, flux-source-controller, kubernetes-dashboard-fips, flannel, bom,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: blob-csi, cloudflared-fips, k8s-metacollector-fips, temporal-ui-server-fips, crossplane-provider-aws-ec2-fips, crossplane-provider-aws-cognitoidp-fips, virt-api, fleet-server, rke2-runtime, flux-source-controller, kubernetes-dashboard-fips, flannel, bom,...

CVE-2026-32280 vulnerabilities

Vulnerabilities for packages: github-mcp-server, blob-csi, cloudflared-fips, opensearch-k8s-operator, k8s-metacollector-fips, temporal-ui-server-fips, crossplane-provider-aws-ec2-fips, logstash-exporter-fips, crossplane-provider-aws-cognitoidp-fips, virt-api, fleet-server, local-static-provisione...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: github-mcp-server, blob-csi, cloudflared-fips, opensearch-k8s-operator, k8s-metacollector-fips, temporal-ui-server-fips, crossplane-provider-aws-ec2-fips, logstash-exporter-fips, crossplane-provider-aws-cognitoidp-fips, virt-api, fleet-server, local-static-provisione...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: github-mcp-server, blob-csi, cloudflared-fips, opensearch-k8s-operator, k8s-metacollector-fips, temporal-ui-server-fips, crossplane-provider-aws-ec2-fips, logstash-exporter-fips, crossplane-provider-aws-cognitoidp-fips, virt-api, fleet-server, local-static-provisione...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: opensearch-k8s-operator, k8s-metacollector-fips, local-static-provisioner, flux-source-controller, amazon-ecs-cni-plugins, rancher-support-bundle-kit, crossplane-provider-aws-kms-fips, docker-cli-buildx, zot, flux-image-reflector-controller, fixuid,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: github-mcp-server, blob-csi, cloudflared-fips, opensearch-k8s-operator, k8s-metacollector-fips, temporal-ui-server-fips, crossplane-provider-aws-ec2-fips, logstash-exporter-fips, crossplane-provider-aws-cognitoidp-fips, virt-api, fleet-server, local-static-provisione...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: github-mcp-server, blob-csi, cloudflared-fips, opensearch-k8s-operator, k8s-metacollector-fips, temporal-ui-server-fips, crossplane-provider-aws-ec2-fips, logstash-exporter-fips, crossplane-provider-aws-cognitoidp-fips, virt-api, fleet-server, local-static-provisione...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the dashboard log endpoints. An attacker can access sensitive operational log data by sending authenticated requests to the log endpoints without requiring elevated privileges. Remediation Upgrade...