CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

EUVD-2026-90447

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

PT-2026-103743

Name of the Vulnerable Software and Affected Versions WPC Shop as a Customer for WooCommerce versions prior to 2.0.1 Description This issue allows for privilege escalation via account takeover. An authenticated attacker can gain full Administrator-level access to a site by supplying an...

PT-2026-103999

Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.2 Description The web interface lacks proper authentication, allowing remote unauthenticated attackers to cause a denial of service on Teledyne FLIR PackBot robots. This is achieved through the misu...

PT-2026-105871

Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...

PT-2026-103690

Name of the Vulnerable Software and Affected Versions Form Tools versions prior to 3.1.2 Description A server-side request forgery exists in the AJAX Endpoint component. The issue occurs within the smart fill function located in the /global/code/actions.php file. A remote attacker can trigger thi...

CVE-2026-103530: Server-Side Request Forgery (SSRF)

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103538: Missing Authentication for Critical Function

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the...

CVE-2026-103252: Authorization Bypass Through User-Controlled Key

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

CVE-2026-76142: Improper Access Control

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

PT-2026-103769

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1783354657)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783354657 advisory. - The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger...

CentOS Linux 6 [TuxCare] Security Update: libsmbclient / libsmbclient-devel / samba / samba-client / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1779902912)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1779902912 advisory. - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply ...

PT-2026-103833

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 1.3.0 through 3.18.0 Description The batch-requests plugin contains a flaw where resources are allocated without limits or throttling. An unauthenticated caller can cause a gateway worker to experience Out of Memory OOM—...

CVE-2026-103280: Insertion of Sensitive Information Into Sent Data

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...

CVE-2026-56662: Cross-Site Request Forgery (CSRF)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

PT-2026-103668

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId lead...

PT-2026-103669

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the...

CVE-2026-14983: Missing Authentication for Critical Function

Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint...