CVE-2026-96604: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

CVE-2026-95833: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

PT-2026-97609

Name of the Vulnerable Software and Affected Versions SoftNews Media Group DataLife Engine version 18.0 Description An issue exists in the Search Module within the strip data function of the engine/modules/search.php file. A remote attacker can trigger a SQL injection by manipulating the story...

CVE-2026-95833 itsourcecode Leave Management System index.php sql injection

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

GHSA-6VMQ-24H2-PJ7J MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

CVE-2026-83801

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801

Nautobot is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.4.37 and 3.1.8 . The root cause is the lack of adequate neutralization when user-controlled values—specifically Relationship descriptions (requiring extras.add_relationship / extras.change_relationship) or Module F...

EUVD-2026-84814

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-77271

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

CVE-2026-43642

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

CVE-2026-43641

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

CVE-2026-43643

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

EUVD-2026-84629

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...