MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

EUVD-2026-42995

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint...

Snipe-IT has CSV formula injection in Activity Report export

Impact In Snipe-IT v8.6.1 and lower, Actionlog::logaction stores the request User-Agent header in useragent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport and written with plain fputcsv. A low-privileged authenticated user can set a...

GHSA-WHRX-MMGR-GPCF Snipe-IT has CSV formula injection in Activity Report export

Impact In Snipe-IT v8.6.1 and lower, Actionlog::logaction stores the request User-Agent header in useragent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport and written with plain fputcsv. A low-privileged authenticated user can set a...

SUSE CVE-2026-80604

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally called hidgetreport before performing any size validation. Inside...

CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-16707

creationtimestamp| type| source ---|---|--- 2026-08-28 15:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5owrtbpc2y...

CVE-2026-82078

creationtimestamp| type| source ---|---|--- 2026-08-28 13:05:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mu5ggzdvtt2j 2026-08-28 14:45:33+00:00| seen| https://bsky.app/profile/infosecbot.bsky.social/post/3mu5m2gyywh25 2026-08-28 16:15:05+00:00| seen|...

MAL-2026-14588 Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

AZL-98163 CVE-2026-80629 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: npc: Fix size of entry2cntrmap KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam-entry2cntrmap is not allocated for reserved entries. BUG: KASAN:...

EUVD-2026-67341

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

EUVD-2026-67352

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2026-78614

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78615

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2026-76797: Improper Neutralization of Formula Elements in a CSV File

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76798: Improper Neutralization of Input During Web Page Generation

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-78614: Deserialization of Untrusted Data

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...