CVE-2026-116748

A flaw was found in Transmission. This vulnerability allows a remote attacker to execute arbitrary code, modify application settings, or delete data by exploiting an overly permissive Cross-Origin Resource Sharing CORS policy in the remote procedure call RPC server. By tricking a user into visiti...

CVE-2026-116748

Transmission versions 4.0.0 before 4.1.3 are affected by a permissive CORS vulnerability within the handle_request() function in rpc-server.cc. This flaw allows any web origin to access the X-Transmission-Session-Id anti-CSRF token from the 409 handshake response. An attacker can leverage this to...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: SQL Injection CWE: CWE-89 Affected Endpoint: /admin/jobs-admins/delete-jobs.php Parameter: id GET Impact: Allows deletion of all job records in th...

CVE-2026-19478

CVE-2026-19478 GitLab GraphQL unauthenticated project deletion ★ CVE-2026-19478 GitLab GraphQL @glintroduced unauthenticated arbitrary-method-invocation PoC ★ https://github.com/user-attachments/assets/bb5d5f8a-a9bf-4148-854b-14c25c501d4b Overview CVE-2026-19478 is an unauthenticated...

CVE-2026-113438

The Pleasanter product contains a vulnerability where it fails to properly verify passwords during LDAP authentication when processing specially crafted requests under specific configurations. This flaw allows an attacker to bypass authentication by providing only a valid Login ID without a passw...

WordPress TS Poll < 2.4.0 - SQL Injection

WordPress TS Poll plugin 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges. id: CVE-2024-8625 info: name: WordPress TS Poll 2.4.0 - SQL...

PT-2026-122231

Name of the Vulnerable Software and Affected Versions langgraph-checkpoint-postgres versions prior to 3.1.3 langgraph-checkpoint-sqlite versions prior to 3.1.2 Description PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels using ".".joinnamespace, which...

CVE-2026-91381

A flaw was found in OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification or deletion by submitting untrusted input to APIs in the 2D graphics component. Exploitation can occur through network services that pass data to these APIs or in clie...

CVE-2026-91396

A flaw was found in the Utility component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by supplying untrusted data to component APIs over the network. A successful attack can allow unauthorized modification or deletion of accessible data and cause a partial Denial...

CVE-2026-114397

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODEENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the...

CVE-2026-114397 Trudesk through 1.2.11 Missing Authentication on Debug Routes

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODEENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the...

EUVD-2026-107244

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODEENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the...

CVE-2026-114397

The Trudesk application (versions through 1.2.11 ) contains a missing authentication vulnerability within its debug routes. This issue occurs when the NODE_ENV environment variable is left unset, allowing unauthenticated remote attackers to access sensitive debug endpoints. Specifically, attacker...

CVE-2026-114397 Trudesk through 1.2.11 Missing Authentication on Debug Routes

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODEENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the...

CVE-2026-59229

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

EUVD-2026-107167

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

CVE-2026-59229

Apache IoTDB (versions 2.0.0 before 2.0.11) is vulnerable to a privilege escalation issue in the Legacy Pipe receiver protocol (handshake / sendPipeData). The vulnerability arises because the protocol uses a hardcoded SUPER_USER (root) identity to execute data loading and deletion operations. Con...

PT-2026-120584

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using th...

PT-2026-120524

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPER USER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USE PIPE or MAINTAIN who does NOT have WRITE DATA or DELETE DATA permissions on target databas...