GO-2026-6180 vulnerabilities

Vulnerabilities for packages: nerdctl, prometheus-mongodb-exporter, terraform, kyverno, zot, aactl, containerd, k3s, kots, reports-server, k8s-device-plugin, k3d, spire-server, snyk-cli...

GO-2026-6179 vulnerabilities

Vulnerabilities for packages: nerdctl, prometheus-mongodb-exporter, terraform, kyverno, zot, aactl, containerd, k3s, kots, reports-server, k8s-device-plugin, k3d, spire-server, snyk-cli...

CVE-2026-56865 vulnerabilities

Vulnerabilities for packages: nerdctl, prometheus-mongodb-exporter, terraform, kyverno, zot, aactl, containerd, k3s, kots, reports-server, k8s-device-plugin, k3d, spire-server, snyk-cli...

CVE-2026-56864 vulnerabilities

Vulnerabilities for packages: nerdctl, prometheus-mongodb-exporter, terraform, kyverno, zot, aactl, containerd, k3s, kots, reports-server, k8s-device-plugin, k3d, spire-server, snyk-cli...

CVE-2026-65938

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-65938

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

EUVD-2026-57263

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-65938

WhatsUp Gold is affected in versions released before 2026.0.2 by an improper authorization vulnerability in the Scheduled Reports API that lets any authenticated user invoke restricted actions. The issue is documented across CVE-2026-65938 entries (NVD, CVE List) and is addressed in the 26.0.2 re...

PT-2026-71119

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

CVE-2026-62293

CVE-2026-62293 affects HAPI FHIR (Java) prior to 6.9.11. The vulnerability arises when the hidden scan command concatenates attacker‑controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java, enabling stored XSS in the generated ...

CVE-2026-67434

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

PHP_CodeSniffer gitblame report command injection via crafted filename

Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

CVE-2026-67434 PHP_CodeSniffer gitblame report command injection via crafted filename

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70441

Summary: CVE-2026-70441 affects Jenkins’ Summary Display Plugin v1.15 and earlier. The root cause is failure to escape the job name in a JavaScript context on build report pages, enabling a stored XSS vulnerability. Impact/conditions: exploit requires Item/Create or Item/Configure permissions; th...