EUVD-2026-57274

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-67587

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-66379

An authenticated user may view private Puppet module metadata without repository read access...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the process that handles backend controller method dispatching via the handler POST field. An attacker can execute unauthorized controller methods by submitting crafted POST requests...

Improper Handling of Insufficient Permissions or Privileges

Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges in the Cms\Controllers\Index process. An attacker can gain unauthorized access to template types and upload assets by crafting AJAX requests with insufficient permission checks...

CVE-2026-66379

CVE-2026-66379 describes an issue where an authenticated user can view private Puppet module metadata without repository read access. The provided documents do not specify affected product/version or the exact root cause. The NVD entry lists CVSS v3.1 base score 4.3 (Medium) with confidentiality ...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the numberrange scope of the backend filter widget when the conditions key is configured. An attacker can access sensitive database information by injecting arbitrary SQL through the filter's AJAX handler. This is only...

CVE-2026-47233

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233

CVE-2026-47233 details an incomplete fix in Admidio where field_delete in modules/inventory.php validates only a CSRF token and does not enforce isAdministratorInventory(), allowing any logged-in user to delete non-system inventory fields. The related ItemField::delete() path lacks an admin check...

CVE-2026-47232

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

EUVD-2026-57207

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47228

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-47228 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...