CVE-2026-72908

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the gettaxtemplate function in erpnext/accounts/doctype/taxrule/taxrule.py constructs an SQL WHERE clause from request-influenced postingdate and args values, allowing an authenticated low-privileg...

CVE-2025-15681 Insufficient Webserver Authentication

TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the...

EUVD-2026-55731

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

CVE-2026-72900 Metabase information exposure

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database...

CVE-2026-72900

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database...

CVE-2026-48048

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to...

CVE-2026-72719

Chatwoot’s CVE-2026-72719 affects the Chatwoot application prior to version 4.9.0, where an authenticated account administrator could transfer resources across accounts via the writable account_id parameter. Affected resources include Portals, Automation Rules, Macros, and Twilio Channels, potent...

CVE-2026-72760 cti-transmute Following List Exposes User Email Addresses to Authenticated Users

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72760

The CVE-2026-72760 issue affects MISP cti-transmute where the account following-list endpoint returns the followed user’s email field in get_following() in addition to name, user ID, and follow date. The root cause is that email is included in the API response despite not being required for follo...

ROOT-OS-ALPINE-323-CVE-2026-11564 CVE-2026-11564 in curl - Patched by Root

Root has patched CVE-2026-11564 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

CVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-63106 ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-6373

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

CVE-2026-12984

CVE-2026-12984 concerns Zyxel Networks WAH7601 (affected through 20072026). The vulnerability is described as Insufficiently Protected Credentials that allows retrieval of embedded sensitive data. Connected documents confirm the affected product and the core impact, but do not provide detailed ro...

CVE-2026-12984 Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...

CVE-2026-6373

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

CVE-2026-6373 Sensitive Data Exposure in Zyxel WAH7601 Router

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

EUVD-2026-55620

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

CVE-2026-6373

CVE-2026-6373 affects Zyxel Networks WAH7601 routers (through 20072026). Described as exposure of sensitive system information to an unauthorized control sphere, enabling Web Application Fingerprinting. CVSS 3.1 base score 6.5 (Medium); metrics show Adjacent attack vector, no privileges required,...

CVE-2026-19429

Jenkins FilePath.untarFrom in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by...