CVE-2026-80184

OpenStack Keystone versions before 29.0.3 are affected by a project-scope escape vulnerability in the token-method authentication path. Tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, or trusts) can be submitted for reauthentication and, whe...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

EUVD-2026-65620

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the pa...

CVE-2026-26211

Ekushey Project Manager CRM 5.0 is affected by a stored XSS vulnerability in the administrator-configured system name field. The value is written to the login page without output encoding, and its occurrence in an h4 element is parsed as markup, causing any injected HTML event handlers to execute...

Vulnerabilities are handled in GitLab through GitLab Inc.

GitLab Inc. has identified vulnerabilities in the GitLab Community Edition CE and Enterprise Edition EE. These vulnerabilities reside in the GraphQL implementation of GitLab. The first vulnerability allowed unauthorized users to perform unauthorized modifications or deletions on public projects a...

CVE-2026-78470

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78470

WP Project Manager Pro is a WordPress plugin vulnerable to SQL Injection in all versions up to and including 4.0.1 . The root cause is insufficient escaping on a user-supplied parameter combined with a lack of prepared statements in the existing SQL query. An authenticated attacker with Subscribe...

EUVD-2026-65299

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

EUVD-2026-65169

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

PT-2026-81176

Name of the Vulnerable Software and Affected Versions WP Project Manager Pro versions prior to 4.0.2 Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL...

Ekushey Project Manager CRM 5.0 Cross Site Scripting

A persistent cross site scripting vulnerability was identified in Ekushey Project Manager CRM version 5.0. The issue was found in the application settings, specifically the Name field. CVE-2026-26211 — Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0...

PT-2026-81880

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-78262

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

CVE-2026-78262

WP Project Manager (WordPress plugin by WeDevs ) is affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 4.0.6 . The flaw allows a remote, unauthenticated attacker over the network with low complexity and no user interaction to achieve high impact on confidentiality, in...

CVE-2026-78262 WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

CVE-2026-77923

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

CVE-2026-77923

Dolibarr versions 21.0.0 through 24.0.0 (exclusive) contain an authorization bypass in the clonetasks mass action handler (htdocs/core/actions_massactions.inc.php). An inverted boolean condition (!in_array()) in the private-project membership check allows any authenticated user with project creat...

CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...