CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81673

CVE-2026-81673 affects the TOOOLS iSquad application, where the /ws/apitribuna/setVisita endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The root cause is the absence of input validation or sanitization before these values are embedded in SQL queries. A remo...

CVE-2026-81673 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

CVE-2026-81673 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

EUVD-2026-67008

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

EUVD-2026-67007

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743

Flowintel versions >=3.3.0 allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this value, an attacker with high privileges can set LOG_...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-66155

A vulnerability has been identified in Element maps-ng V47 All versions V47.12.3, Element maps-ng V48 All versions V48.11.3, Element maps-ng V49 All versions V49.16.1. The si-map component does not properly neutralize user-controllable input of the points property that is used to render the toolt...

CVE-2026-66155

A vulnerability has been identified in Element maps-ng V47 All versions V47.12.3, Element maps-ng V48 All versions V48.11.3, Element maps-ng V49 All versions V49.16.1. The si-map component does not properly neutralize user-controllable input of the points property that is used to render the toolt...

CVE-2026-66155

Siemens Element maps-ng (V47, V48, V49) is affected by an XSS vulnerability in the si-map component. The root cause is improper neutralization of user-controllable input in the points property, which is used to render the tooltip label of map pins . An attacker can craft a malicious URL that, whe...

EUVD-2026-67006

A vulnerability has been identified in Element maps-ng V47 All versions V47.12.3, Element maps-ng V48 All versions V48.11.3, Element maps-ng V49 All versions V49.16.1. The si-map component does not properly neutralize user-controllable input of the points property that is used to render the toolt...

Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks

The Australian Federal Police AFP has charged two Western Australian men with a combined total of 14 offences over their alleged role in TeamPCP , the cybercrime group behind the March 2026 compromise of the open-source security scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM. Louis...

Learn How to Build Security Operations Ready for AI-Powered Attacks

Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster than traditional security...

CVE-2026-81672 Multiple Vulnerabilities in TOOOLS' iSquad

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...

CVE-2026-81672

CVE-2026-81672 is a SQL injection vulnerability in TOOOLS' iSquad , affecting the /ws/apiprensa/getVideoSubcanal endpoint. The root cause is improper handling of the id_video parameter: the application does not sanitize input before constructing SQL queries, leading to execution errors with malic...

EUVD-2026-67005

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...