CVE-2026-61568: Reliance on Reverse DNS Resolution for a Security-Critical Action

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preservin...

PT-2026-91935

Name of the Vulnerable Software and Affected Versions pig versions prior to 4.1.0 Description An authentication bypass exists in the '/register/password' endpoint. The system discards the results of the current password verification, which allows any value to be accepted as the current password...

CVE-2026-62280: Improper Neutralization of Input During Web Page Generation

Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...

CVE-2026-88617

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

PT-2026-91831

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

EUVD-2026-78624

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

CVE-2026-76705: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-76701: Missing Authentication for Critical Function

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to netwo...

CVE-2026-88617: Incorrect Authorization

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

CVE-2026-90841: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

PT-2026-92465

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

PT-2026-92438

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description A flaw in the API endpoint allows a low-privilege authenticated remote attacker to escalate privileges. This could lead to the execution of arbitrary system...

PT-2026-92034

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

PT-2026-92087

Name of the Vulnerable Software and Affected Versions vikunja versions prior to 2.6.0 Description A resource exhaustion issue exists in the '/task-filter' endpoint. The system accepts deeply nested filter expressions without enforcing recursion depth limits. Authenticated attackers can provide...

CVE-2026-91772: URL Redirection to Untrusted Site

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

CVE-2026-44203: Improper Neutralization of Input During Web Page Generation

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

EUVD-2026-78812

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve...

PT-2026-92466

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description An issue in the API endpoint allows an unauthenticated remote attacker to obtain sensitive information. This could lead to the disclosure of...

PT-2026-92447

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description A flaw in the API endpoint allows a low-privilege authenticated remote attacker to escalate privileges. This could lead to the execution of arbitrary...

CVE-2026-76706: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, whic...