EUVD-2026-71017

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

EUVD-2026-71016

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...

CVE-2026-85593

phpMyFAQ versions before 4.1.8 are affected by a stored XSS vulnerability in FaqHelper::convertOldInternalLinks(). The root cause is a call to html_entity_decode() on already-sanitized FAQ content, which reverses the entity-encoding protection that was applied during sanitization. Any authenticat...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85593 phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...

CVE-2026-85594

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider . A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its ...

CVE-2026-85593 phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...

CVE-2026-85592 phpMyFAQ before 4.1.8 Authorization Bypass via question/create

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

EUVD-2026-71015

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

CVE-2026-85592

phpMyFAQ versions before 4.1.8 are affected by an authorization bypass in the question/create API endpoint. The underlying cause is that the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, while ignoring the records.allowQuestionsForGuests s...

CVE-2026-85592 phpMyFAQ before 4.1.8 Authorization Bypass via question/create

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

CVE-2026-85592 phpMyFAQ before 4.1.8 Authorization Bypass via question/create

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

CVE-2026-85590 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

EUVD-2026-71014

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

EUVD-2026-71013

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

CVE-2026-85590 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...