CVE-2026-40486 Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint PATCH /api/users/id/preferences applies submitted preference values without checking the isEnabled flag on preference objects. Although the hourlyrate and internalrate fields are...

EUVD-2025-206425

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and...

PT-2026-5183

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0 Description Discourse, an open source discussion platform, is subject to an application-level...

PT-2024-22606 · Ampache · Ampache

Name of the Vulnerable Software and Affected Versions: Ampache versions prior to 6.3.1 Description: A stored Cross Site Scripting XSS issue allows a remote attacker to execute code via a crafted payload to several parameters in the post request of "/preferences.php?action=admin update preferences...

SonicWALL SonicOS Buffer Error Vulnerability

SonicWALL SonicOS is a set of operating systems from SonicWALL, Inc. designed for SonicWall firewall appliances. A security vulnerability exists in SonicWALL SonicOS that stems from a stack-based buffer overflow vulnerability in the sonicwall.exp, prefs.exp URL endpoints that causes the firewall ...

PT-2021-23938 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.7.11 Description: A vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature in Discourse, an open source discussion platform. This feature allows a tag group ...