CVE-2026-86137

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds...

PT-2026-86854

In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation...

CVE-2025-67876

CVE-2025-67876: ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking Overview...

CVE-2012-5519

cups-root-file-read.sh ⭐ a bash implementation of the metasploit 'cupsrootfileread.rb' module designed for pentesting and CTFs. mainly a short exercise in bash scripting. intended to be a self-contained program that exploits CVE-2012-5519 on linux systems; it provides the user with an interactive...

CVE-2026-85038

CVE-2026-85038 affects the B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin for WordPress in versions before 5.2.40 . The root cause is a missing server-side verification of the role selected during self-registration: the plugin does not confirm that the submitted role is one actually offe...

CVE-2026-86193

grav-plugin-api versions before 1.0.20 contain an authentication bypass in its user-management guards. The root cause is a failure to validate group-inherited super permissions , allowing non-super user managers holding api.access and api.users.write to modify super-admin accounts by patching the...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-14466

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

EUVD-2026-71218

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

CVE-2026-14466

Stormshield SNS is vulnerable to a stored XSS in its web administration panel. An SNS administrator with appropriate permissions can inject a malicious script into a group's comments within the webservices administration interface , leading to execution in the context of other users. The CVSS v3....

CVE-2026-85546

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546

MISP is affected by a cross-site request forgery (CSRF) vulnerability in its sharing group quick-edit functionality. The root cause lies in the __initialiseSGQuickEdit() helper, where the allowMethod(['post']) call was commented out, allowing the addOrg, removeOrg, addServer, and removeServer act...

EUVD-2026-70981

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85533

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

CVE-2026-85533

CVE-2026-85533 is an authorization bypass in MISP (Malware Information Sharing Platform). In attribute attachment/editing and Galaxy Cluster creation/editing workflows, the Sharing Group authorization check was only executed when the distribution field was explicitly set to 4. By omitting or mani...

CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

EUVD-2026-70976

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...