CVE-2026-16058: Authorization Bypass Through User-Controlled Key

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and...

PT-2026-79934

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-68558: Server-Side Request Forgery (SSRF)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

PT-2026-79876

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

CVE-2026-50191

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register...

EUVD-2026-62201

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register...

CVE-2026-70910

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: REST. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of...

GHSA-7GWW-X7FH-JF9J LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

Summary The Oxidized integration URL oxidized.url is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields name, ip, model, author, commit message into HTML without htmlspecialchars. An admin pointing the URL at an attacker-controlled server...

Server-side Request Forgery (SSRF)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the processing of JSON fields from an external API response in the device...

CVE-2026-62591

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful...

CVE-2026-62593

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. While the...

CVE-2026-62594

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Integration. While th...

CVE-2026-62588

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. While the...

CVE-2026-62589

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. While th...

CVE-2026-62590

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. While the...

CVE-2026-62592

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful...

CVE-2026-62595

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware...

CVE-2026-62596

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration. Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. While the...

CVE-2026-60831

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Integration Broker. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris...

CVE-2026-60796

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: REST. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of...