CVE-2026-71459: Missing Authorization

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

CVE-2026-71460: Missing Authorization

/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...

CVE-2026-71461: Generation of Error Message Containing Sensitive Information

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-96826: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-95957: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...

CVE-2026-94684: Improper Neutralization of Input During Web Page Generation

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection...

CVE-2026-94682: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...

CVE-2026-95601: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...

CVE-2026-95600: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...

CVE-2026-95527: Missing Authorization

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-95525: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

CVE-2026-95590: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

CVE-2026-95586: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

CVE-2026-95530: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

CVE-2026-94457: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...

CVE-2026-94118: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...

CVE-2026-6327: Improper Output Neutralization for Logs

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-6721: Improper Neutralization of Special Elements used in an OS Command

IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the...

CVE-2026-71465: Improper Neutralization of Argument Delimiters in a Command

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-71463: Generation of Error Message Containing Sensitive Information

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...