CVE-2026-13202 HTML Injection in OTDS Swagger UI

A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2...

EUVD-2026-60232

A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2...

CVE-2026-13202

A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2...

CVE-2026-13202

OpenText OTDS (Directory Services) through v22.2 contains an HTML Injection flaw in the Swagger UI component. The CVSS 4.0 score is 8.6 (HIGH) with network attack vector, no authentication required, and high confidentiality/integrity impact. A proof-of-concept exists; OpenText KB0870915 and PT Se...

CVE-2026-75004

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...

WordPress Pinpoint Booking System plugin <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability

Unauthenticated Improper Input Validation to Price Manipulation via 'cartdata' Parameter vulnerability discovered by WordFence in WordPress Plugin Pinpoint Booking System versions = 2.9.9.6.8...

CVE-2026-65913

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...

CVE-2026-65902

A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and...

EUVD-2026-60062

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...

CVE-2026-19996

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...

CVE-2026-19978

A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function childprocess.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument...

CVE-2026-42162

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

The vulnerability of the amdgpu_device_ip_init() function in the drivers/gpu/drm/amd/amdgpu/amdgpu_device.c source file of the Direct Rendering Infrastructure (DRI) driver for AMD GPU cores in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the amdgpudeviceipinit function in the drivers/gpu/drm/amd/amdgpu/amdgpudevice.c file of the Direct Rendering Infrastructure DRI driver for AMD GPU cores in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to...

PT-2026-76884

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma qty/resolution type/rma reason id results in enforcement of behavioral workflow. The attack may be performed from remote. The...

PT-2026-76673

A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2...

CVE-2026-42162

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

The vulnerability of the __req_mod() function in the drivers/block/drbd/drbd_req.c module of the Linux kernel’s block device driver allows a attacker to cause a service failure.

The vulnerability of the reqmod function in the drivers/block/drbd/drbdreq.c file of the Linux kernel’s block device driver involves pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

VulnCheck KEV: CVE-2025-52907

Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360B20241207...

PT-2026-76879

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 25.04.5 Mahara versions prior to 26.04.0 Description An issue exists where artefacts may become accessible to unauthorized users if the file path to an artefact within a page is manipulated. Recommendations Update to...

PT-2026-76692

Name of the Vulnerable Software and Affected Versions New API versions prior to 1.0.0-rc.18 Description An issue exists where user-controlled quantity parameters can cause overflow conversions during quota calculations in common/quota math.go and related settlement paths. A low-privileged account...