EUVD-2026-78839

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...

CVE-2026-18111 Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...

CVE-2026-91985

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

CVE-2026-55775

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

USN-8770-1: SimpleSAMLphp vulnerabilities

It was discovered that SimpleSAMLphp incorrectly validated cryptographic signatures in XML messages. An authenticated attacker could possibly use this issue to impersonate users or gain elevated privileges. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2019-3465 It was...

leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...

leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...

CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...

WordPress JetFormBuilder plugin <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

Unauthenticated Privilege Escalation via 'jetenginebookingformid' Parameter vulnerability discovered by daroo in WordPress Plugin JetFormBuilder versions = 3.6.2...

Vulnerabilities found in Apple iOS and iPadOS

Apple has identified several vulnerabilities in iOS and iPadOS. These vulnerabilities involve various security issues, such as authentication failures, out-of-bounds write and read errors, use-after-free situations, buffer overflows, race conditions, permission and authorization problems, memory...

CVE-2026-55636

Capsule (a multi-tenancy and policy-based framework for Kubernetes) versions 0.13.0 through 0.13.6 contain a singular/plural typo in charts/capsule/templates/configuration.yaml: the validating webhook rule specifies namespace/finalize instead of namespaces/finalize. Because Kubernetes webhook rul...

WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Devlin Jenkins in WordPress Plugin TrueBooker versions = 1.2.3...

CVE-2026-65831 ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/database with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization...

CVE-2026-65831 ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/database with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization...

CVE-2026-65831 ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/database with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization...

CVE-2026-91985

Vikunja before 2.6.0 contains an access-control flaw in its single-share read endpoints: the link-share hash field is not properly restricted, allowing read-only members to obtain the share's secret credential. An attacker can then exchange that hash for a link-share JWT at the share's permission...

CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

EUVD-2026-78656

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...