CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477

The ash-project ash framework is vulnerable to an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability. In versions 2.17.15 before 3.33.11 , the Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 functions fail to verify ...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-92829

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 9.1.0 . The root cause is the plugin's failure to properly verify user authorization for specific actions, compounded by the fact that the b2s_secu...

Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection

A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this...

VulnCheck KEV: CVE-2026-42608

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...

SUSE SLES12 Security Update : hplip (SUSE-SU-2026:4335-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4335-1 advisory. - CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of...

PT-2026-99076

Name of the Vulnerable Software and Affected Versions GLPI versions 0.85 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected...

PT-2026-98808

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/amdxdna component where the amdxdna cmd chain structure uses a flexible array annotated with counted bycommand count. Because this structure is stored in...

CVE-2026-92829: Missing Authorization

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-42323: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

CVE-2026-13016

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-13016 Unauthenticated SQL Injection in ServiceNow AI Platform

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

EUVD-2026-86399

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Modification vulnerability discovered by Averon Averenkov Averon Averenkov in WordPress Plugin Blog2Social versions = 9.1.0...

CVE-2026-84302

The open-source discussion platform Discourse is vulnerable in versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 . The root cause is that reviewable visibility filtering fails to restrict Discourse AI reviewables associated with private messages. This allows moderators who are not part...

CVE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

CVE-2026-3253

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

EUVD-2026-85854

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...