PT-2026-69156

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.81.1 lakeFS Enterprise versions prior to 1.84.0 Description The Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commi...

CVE-2025-71410: Allocation of Resources Without Limits or Throttling

Unnumbered Disconnect U DISC and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio...

CVE-2026-17600: Insufficient Session Expiration

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue...

PT-2026-69091

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 5.9.2 Description The launcher activity AppActivity is declared as exported with launchMode="singleTask" and lacks a permission guard. The application invokes Intent.getUserSession during onCreate...

CVE-2026-48026: Improper Neutralization of Input During Web Page Generation

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write...

CVE-2026-19016: Improper Limitation of a Pathname to a Restricted Directory

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

PT-2026-69129

Name of the Vulnerable Software and Affected Versions Domoticz versions prior to 2026.3 Description A stored cross-site scripting issue exists in the mobile dashboard. Authenticated attackers can inject arbitrary HTML and JavaScript by updating device values of the Text or Alert subtypes through...

CVE-2026-37171

A lack of tenant separation in SuperTokens Core versions v6.0.0 through v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints belonging to another tenant. This Incorrect Authorization issue allows for unauthorized cross-tenant access. At this time, no newer v...

CVE-2026-19264: Improper Limitation of a Pathname to a Restricted Directory

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

PT-2026-69062

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository 3 affected versions not specified Description Sonatype Nexus Repository 3 fails to immediately terminate active login sessions or revoke cached permissions when a user account is deleted, deactivated, or has its...

PT-2026-69094

Name of the Vulnerable Software and Affected Versions Plesk versions prior to 18.0.80 Description Improper privilege management in the XML-RPC API allows an authenticated reseller to obtain an administrative session for the root user account. Recommendations Update to version 18.0.80 or later...

CVE-2026-17599: Unverified Password Change

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

PT-2026-69122

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.19.1 through 2.0.2 Consul Enterprise versions 1.19.1 through 2.0.2 Description An authorization bypass exists in the transaction API where the session:write ACL permission is not enforced during session...

CVE-2026-44965: Improper Export of Android Application Components

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

SimpleHelp 5.5.x < 5.5.16 OIDC Authentication Bypass

The version of SimpleHelp running on the remote web server is 5.5.x prior to 5.5.16 or a 6.0 pre-release prior to 6.0 RC2. It is, therefore, affected by an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during...

Malicious code in @prototypevip/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b0068015e90b8e47dd9b67c66ed1d0b0cc4c1ebccd985f08efd31837d27ce8 @prototypevip/baileys is a fork of the Baileys WhatsApp library. lib/Store/prototype-store.js registers a listener on the 'messages.upsert' event tha...

MAL-2026-13480 Malicious code in @prototypevip/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b0068015e90b8e47dd9b67c66ed1d0b0cc4c1ebccd985f08efd31837d27ce8 @prototypevip/baileys is a fork of the Baileys WhatsApp library. lib/Store/prototype-store.js registers a listener on the 'messages.upsert' event tha...

CVE-2026-5336

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

CVE-2026-48079

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

Craft CMS: Stored XSS in the control panel via unescaped draft name

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...