CVE-2026-58507: Improper Access Control

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-73482: Cross-Site Request Forgery (CSRF)

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

PT-2026-71733

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.7.0-RC5 Description A cross-site request forgery CSRF issue exists in the 'lists/admin/admins.php' endpoint. The administrator deletion action is triggered via a GET request using the delete parameter that lacks CSR...

PT-2026-80542

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get string function in xlstool.c:411...

CVE-2026-73304: Exposure of Sensitive Information to an Unauthorized Actor

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...

CVE-2026-73488: Authorization Bypass Through User-Controlled Key

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

CVE-2026-73604: Exposure of Sensitive Information to an Unauthorized Actor

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...

PT-2026-71732

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.7.0-RC5 Description Cross-Site Request Forgery CSRF occurs because the application fails to enforce token validation on the bounce rule deletion endpoints 'bouncerules.php' and 'bouncerule.php'. The deletion process...

CVE-2026-73229

A flaw was found in Django REST framework. The AdminRenderer component, when processing an invalid write request, can improperly invoke a GET request without adequate permission checks. This oversight allows an unauthenticated attacker to access data that they are not authorized to view, leading ...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the document.title assignment in JavaScript, where user-supplied GET parameters are...

GHSA-JMQM-F8Q4-V7WX LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only striptags applied directly into $pagetitle. A single quote terminates the JS string, executing arbitra...

LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only striptags applied directly into $pagetitle. A single quote terminates the JS string, executing arbitra...

CVE-2026-47229

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

CVE-2026-47229 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

EUVD-2026-57206

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

PT-2026-76558

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.5.0 Description The Proxmox application view contains a reflected cross-site scripting issue. The application fails to adequately encode the instance and vmid GET parameters before reflecting them into the page...

CVE-2026-47717: Insertion of Sensitive Information Into Sent Data

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue...

PT-2026-105506

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize value without the check forbidden xcom keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow...

PT-2026-75981

Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only strip tags applied directly into $pagetitle. A single quote terminates the JS string, executing...

PT-2026-102297

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize value without the check forbidden xcom keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow...