CVE-2026-73326

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

CVE-2026-73326 CamaleonCMS Missing Authorization via Plugin Administration Endpoints

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration...

CVE-2026-73407

Budibase CVE-2026-73407: Unauthenticated REST datasource credential theft via cross-origin auth leak in RestIntegration._req (packages/server/src/integrations/rest.ts) prior to 3.40.1. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId could supply an absolute or parameterized pa...

CVE-2026-73332 CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field

CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...

CVE-2026-73308 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in...

CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73329

CVE-2026-73329 affects CamaleonCMS. It is a stored XSS vulnerability where authenticated low-privilege users can inject unsanitized HTML into the draft post title via the drafts creation endpoint. The payload is persisted to the database and later rendered as raw HTML in the admin drafts listing,...

CVE-2026-69106

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...

CVE-2026-73300 Budibase: SQL Injection via `multipleStatements: true`

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading t...

CVE-2026-69106

The CVE-2026-69106 entry concerns JFrog Artifactory (self-managed releases). A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. The NVD/CVE records confirm this as a high-severity issue (CVSS v3.1 base ...

CVE-2026-69106 Potential cache poisoning in JFrog Artifactory

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...

EUVD-2026-57389

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...

CVE-2026-69106 Potential cache poisoning in JFrog Artifactory

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...

CVE-2026-65926

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-64639

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-19429

A flaw was found in Jenkins. An authenticated remote attacker with low privileges could exploit an incomplete patch related to symlink validation during tar archive extraction. This vulnerability allows the attacker to bypass symlink target validation, enabling them to read arbitrary files on the...

CVE-2026-64639

CVE-2026-64639 describes an incorrect database cloning process in Plesk versions 18.0.52 before 18.0.79.6 and 18.0.80.2, which allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator. The documentation does not provide additional ...

EUVD-2026-57273

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-64639

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...