CVE-2026-126182

A code injection vulnerability (CWE-94 ) exists in the GUI of FortiManager , FortiManager Cloud , FortiAnalyzer , and FortiAnalyzer Cloud . This flaw allows a remote authenticated attacker to execute unauthorized code or commands by sending crafted HTTP requests . Affected versions include FortiM...

CVE-2026-126784 Uncontrolled resource consumption via post_notice

Missing rate limiting, per-account submission quota and geographic validation in the publicaraviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

Cisco Unified Communications Manager 7/8/9 - Directory Traversal

A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 id: CVE-2013-5528 info: name:...

CVE-2026-83528

Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information...

CVE-2026-105426

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root...

CVE-2026-105427

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service...

EUVD-2026-121278

Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information...

CVE-2026-83528

Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information...

CVE-2026-83528

Ivanti Endpoint Manager Mobile (EPMM) versions 12.10.0.0 and prior , 12.9.0.2 and prior , and 12.8.0.5 and prior are vulnerable to a medium-severity vulnerability (CVE-2026-83528 ) involving the exposure of Personally Identifiable Information (PII) . A remote authenticated attacker with admin pri...

CVE-2026-105427

Ivanti Endpoint Manager Mobile (EPMM) is vulnerable to a denial of service (DoS) condition due to improper input validation . A remote authenticated attacker with admin privileges can exploit this flaw to permanently disable all Apache HTTPS services . This issue affects versions prior to 12.10.0...

EUVD-2026-121271

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root...

CVE-2026-105426

Ivanti Endpoint Manager Mobile (EPMM) is vulnerable to improper input validation in versions before 12.10.0.1 , 12.9.0.3 , and 12.8.0.5 . This flaw allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root, potentially compromising the integrity...

CVE-2026-105426

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root...

CVE-2026-83528: Ivanti Endpoint Manager Mobile: Exposure of PII in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker…

Exposure of PII in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information...

CVE-2026-105426: Ivanti Endpoint Manager Mobile: Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated…

Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root...

PT-2026-141758

Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root...

CVE-2026-105669: Ivanti Sentry: Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin…

Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries...

EUVD-2026-120233

xdrkrb5tldata in lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service memory leak in kadmind via crafted RPC requests that trigger a decode failure...

CVE-2026-112318: Red Hat: The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL…

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 aka krb5 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring, which allows remote authenticated users to cause a denial of service kadmind crash via NULL pointer dereference by sending a policy request wit...