PT-2026-78900

Name of the Vulnerable Software and Affected Versions iCagenda versions 4.0.8 through 4.0.12 Description The frontend Submit an Event form allows authenticated users to perform a Stored Cross-Site Scripting XSS attack. This occurs because the image and file fields are stored as raw strings withou...

BuildKit: Custom frontend could bypass Seccomp/AppArmor

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...

GHSA-7236-3392-C5C6 BuildKit: Custom frontend could bypass Seccomp/AppArmor

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...

EUVD-2026-62838

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-75951

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-75951 Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-75951

J-BusinessDirectory extension (versions before 6.2.3) contains an Insecure Direct Object Reference flaw across multiple frontend/API actions, allowing unauthenticated remote attackers to access or modify other users' data; CVSS 6.9 (Medium). Remediation is to upgrade to version 6.2.3 or later. No...

EUVD-2026-62492

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-75951 Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-75951: Authorization Bypass Through User-Controlled Key

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

PT-2026-78450

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

Linux Distros Unpatched Vulnerability : CVE-2026-23934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend...

Linux Distros Unpatched Vulnerability : CVE-2026-23930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend...

CVE-2026-66638

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66638 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66638 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

EUVD-2026-60923

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66638

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66638

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.10) contains a contributor-level reflected/stored Cross-Site Scripting (XSS) flaw. A user with contributor privileges can inject malicious scripts that execute in other users' browsers. CVSS 3.1 scores this MEDIUM (6.5) with netwo...