PT-2026-71554

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

CVE-2026-15216

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

CVE-2026-15217

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content b...

EUVD-2026-57438

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content b...

CVE-2026-15217 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content b...

CVE-2026-15217

GitLab CVE-2026-15217 describes a cross-site scripting vulnerability in GitLab CE/EE due to improper neutralization of user-controlled values rendered in table cells within an analytics dashboard component. Affected versions are all releases from GitLab 18.2 up to but not including 19.0.6, 19.1 u...

CVE-2026-15217 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content b...

CVE-2026-15216

GitLab CVE-2026-15216 affects GitLab CE/EE prior to patched versions: 19.0.6 (for 18.2 line), 19.1.4 (for 19.1 line), and 19.2.2 (for 19.2 line). The issue arises from improper neutralization of user-controlled data rendered in pagination controls within an analytics dashboard component, enabling...

CVE-2026-15216 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

EUVD-2026-57437

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

CVE-2026-15216 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

CVE-2026-16051 WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute...

CVE-2026-16051 WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute...

CVE-2026-16051

The CVE covers the wpmudev-updates WordPress plugin prior to 5.0.1. Affected component: the remote management interface; it does not verify the integrity of installed packages and lacks replay protection for management requests. This enables an attacker who can obtain or replay a valid signed man...

GitLab 18.2 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-15216)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site...

GitLab 18.2 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-15217)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site...

CVE-2026-11425

A flaw was found in Domoticz. An authenticated attacker can exploit a stored cross-site scripting XSS vulnerability in the mobile dashboard. This allows the attacker to inject malicious code by updating specific device values through the application's programming interface API. When an...

MAL-2026-13762 Malicious code in developer-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fde7491a839ea8dc199215ce4c506b89ec0d9a9b1cded593b063a5b9b7015509 The package presents itself as a 'developer dashboard' but ships a heavily obfuscated single-file payload obfuscator.io-style 0xXXXX identifiers with...

CVE-2026-72743

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...