CVE-2026-73329

CVE-2026-73329 affects CamaleonCMS. It is a stored XSS vulnerability where authenticated low-privilege users can inject unsanitized HTML into the draft post title via the drafts creation endpoint. The payload is persisted to the database and later rendered as raw HTML in the admin drafts listing,...

CVE-2026-65926

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

EUVD-2026-57273

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-64639

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-65926 Private Release Bundle versions may be disclosed under specific configurations

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-65926

Technical details (affected product/versions/exploitability) are not publicly provided in the supplied documents. Monitor for updates from vendor advisories and trusted sources.

EUVD-2026-57257

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-65926

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-66375

CVE-2026-66375 concerns JFrog Artifactory metadata : a low-privilege authenticated user can permanently remove protected internal metadata across repositories under specific conditions. The issue is described across multiple sources (NVD, CVE Registry) with related CVSS 3.1 data: AV:N/AC:L/PR:L/U...

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

EUVD-2025-210688

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution...

EUVD-2025-210694

Uncontrolled search paths in the Vitis™ Embedded Single File Download SFD for local Windows installation could allow a low-privileged user to create arbitrary code execution...

CVE-2025-0041

CVE-2025-0041 describes uncontrolled search paths in the Vitis Embedded Single File Download (SFD) installer for Windows. The issue could allow a low-privilege local user to achieve arbitrary code execution by abusing the DLL/loader search order and loading a malicious library or executable. The ...

EUVD-2026-56003

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

CVE-2026-58241

Technical details about CVE-2026-58241 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-72908

ERPNext contains an SQL injection in get_tax_template (erpnext/accounts/doctype/tax_rule/tax_rule.py) exploitable by an authenticated low-privilege user through request-influenced posting_date and args values. The issue affects pre-15.109.0 and pre-16.20.0 releases and can lead to extraction of s...

EUVD-2026-55666

Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default...

CVE-2026-72576

CVE-2026-72576 : Bludit 4.0.0-beta contains a stored XSS vulnerability exploitable by a low-privileged authenticated user (Author) who uploads a crafted SVG as the site logo. The flaw resides in the /admin/ajax/logo-upload.php path, which moves the uploaded file directly to the web root via Files...

CVE-2026-18666

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

PT-2026-69867

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description A low-privileged user can submit crafted content to the moderation review queue. Th...