Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.12 Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. The C wrapper implementation contains a heap...

CVE-2026-78837

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-61517

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

EUVD-2026-72874

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738

Snipe-IT versions before 8.7.0 are affected by a CSS injection vulnerability in the Custom CSS field . The root cause is incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. A superuser can plant malicious CSS payloads using @import and url() references...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

EUVD-2026-72869

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-86730 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

CVE-2026-86730 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

CVE-2026-86730

Craft CMS versions from 5.0.0-RC1 before 5.10.12 are vulnerable to Remote Code Execution (RCE) due to improper cleansing of string-typed field-layout elements. An authenticated control-panel user can post field-layout tab elements as JSON strings to bypass cleanse validation, injecting Yii2 behav...

CVE-2026-86730 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.32 bug fix and security update

Red Hat OpenShift Container Platform release 4.21.32 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

EUVD-2026-72808

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...