EUVD-2026-102979

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-111688

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-59962 Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sortorder and orderfield strings into Django ORM orderby calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or...

CVE-2026-54657

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the...

Thorsten Rinne phpMyFAQ Resource Management Error Vulnerabilities

Thorsten Rinne’s phpMyFAQ version prior to 4.2.0-beta and 4.2.0-alpha versions contained a resource management vulnerability. This vulnerability stemmed from unauthenticated faqs and search API endpoints, which experienced uncontrolled resource consumption. Attackers could send concurrent GET...

CVE-2026-54657

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the...

EUVD-2026-102899

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the...

CVE-2026-95182

An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...

Chromium CVE-2026-106186: Uncontrolled search path element

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-14452

Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...

EUVD-2026-102834

Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...

CVE-2026-14452 Open redirect and XSS via reset_url parameter

Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...

CVE-2026-14452

Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...

CVE-2026-14452

Checkmk versions <2.5.0p15 , <2.4.0p38 ,

CVE-2026-18256

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams...

CVE-2026-100106

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchasedplan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress FiboSearch – Ajax Search for WooCommerce plugin <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin FiboSearch versions = 1.34.2...

CVE-2026-100106 FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchasedplan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-100106

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.34.2 . The root cause is insufficient input sanitization and output escaping within the purchased_plan parameter. Authenticated attackers with...

EUVD-2026-102816

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchasedplan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...