CVE-2026-6086 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6085

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile API and management panel developed by Novadigits technologies. The flaw is located on the server side within the REST endpoint /inventory/configuration/serial-number-types. It allows a remote, previously authenticated atta...

EUVD-2026-86622

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6085 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6084 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...

EUVD-2026-86620

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...

CVE-2026-6084 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...

CVE-2026-6084

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile application by Novadigits technologies, specifically within the API and management panel . The flaw is located in the server-side REST endpoint /inventory/configuration/variants, where the system fails to properly filter o...

CVE-2026-6083

The StockAgile application by Novadigits technologies contains a Stored Cross-Site Scripting (XSS) vulnerability within the API and management panel. The flaw exists in the REST endpoint /inventory/configuration/pricing-tiers, where the application fails to properly filter or validate input in pa...

EUVD-2026-86619

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

CVE-2026-6083 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

CVE-2026-6083 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

CVE-2026-6082 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’...

CVE-2026-6082

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile API and management panel by Novadigits technologies. The flaw is located in the REST endpoint /inventory/configuration/payment-methods, where malicious JavaScript can be injected and persisted via parameters such as 'code'...

EUVD-2026-86618

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’...

CVE-2026-6082 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’...

CVE-2026-19775 OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-19775 OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 1.1.7 . The root cause is the plugin's failure to properly verify user authorization before performing certain actions. This flaw a...

CVE-2026-92289

A flaw was found in lemonldap-ng. When configured to accept either client secrets or Proof Key for Code Exchange PKCE, a security mechanism designed to protect authorization codes, the portal fails to validate client credentials properly for public clients. A remote attacker who intercepts an...