CVE-2026-72609

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...

GHSA-PR22-P9RP-2CQV Ghost: Cross-Site Scripting in Feature Image Captions

Impact An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation. Vulnerable versions This vulnerability is present in Ghost from v4.9.0 up to v6.54.0. Patches v6.54.1...

CVE-2026-70596

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...

CVE-2026-70596 Ghost: Cross-Site Scripting in Feature Image Captions

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...

CVE-2026-23526

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to...

CVE-2026-23526

CVAT (open-source annotation tool) versions 1.0.0–2.54.0 contain a privilege-escalation issue where users with staff status can freely change their permissions, including granting themselves superuser status and joining the admin group, thereby obtaining full access to data in the instance. The i...