CVE-2026-66083: Missing Authentication for Critical Function

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

PT-2026-102641

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

Paused shared dashboard access tokens still expose data source configuration

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

PT-2026-102508

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

CVE-2026-84464

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

CVE-2026-84464 Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

EUVD-2026-87263

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

CVE-2026-84464 Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

CVE-2026-84464 Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

CVE-2026-84464

The Zammad open source helpdesk system is vulnerable to an Insecure Direct Object Reference (IDOR) in its External Data Source feature. Prior to version 7.1.2 , the system failed to properly verify user permissions when looking up records from external systems. An authenticated user , even one wi...

PT-2026-99089

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The External Data Source feature, which retrieves records from external systems, fails to properly verify user permissions before including record details in requests. An authenticated user with basic...

CVE-2026-84464: Exposure of Sensitive Information to an Unauthorized Actor

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-86784

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

EUVD-2026-80205

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-86784

The Visualizer WordPress plugin (versions before 4.0.8 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitise and escape a chart's JSON data source configuration before it is output back in the chart editor. This allows users with Contributor role p...