PT-2026-97509

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the automation-controller where survey questions of type password, which are intended to be write-only and stored encrypted,...

PT-2026-97431

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.14 Description Cross-site Scripting XSS occurs in the administrative interface because the software fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying...

PT-2026-97442

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.14 Description A reflected cross-site scripting issue exists on the administrative survey-participant CSV import result page. Reflected cross-site scripting occurs when an application includes untrusted...

CVE-2026-92730: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

CVE-2026-90817 is an unauthenticated Remote Code Execution vulnerability in REDCap 13.3.0 and higher , rated CVSS 9.8 (Critical) . The flaw resides in the survey passthrough routing and Data Import processing logic , where an attacker can manipulate HTTP requests to reach an unintended controller...

EUVD-2026-83738

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817: Improper Control of Generation of Code

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

PT-2026-95962

Name of the Vulnerable Software and Affected Versions REDCap versions 13.3.0 through 16.0.48 REDCap versions 17.0.0 through 17.3.9 REDCap versions 17.4.0 through 17.4.3 Description An unauthenticated remote code execution flaw exists in the survey passthrough routing and Data Import processing...

CVE-2026-92602

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-92602

TDuck survey form through version 5.3 is affected by a Server-Side Request Forgery vulnerability in the WebhookConfigController . The root cause is a failure to validate webhook URLs or verify form ownership, allowing authenticated attackers to attach webhooks to other users' forms and exfiltrate...

EUVD-2026-80860

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-92602 TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-92602 TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-92567

TDuck survey form through version 5.0 has an authorization bypass in the POST /user/form/data/update endpoint. Authenticated users can overwrite other users' form submission data because the update request lacks ownership validation , and submission identifiers are allocated in narrow ranges that...

CVE-2026-92567 TDuck survey form through 5.0 Unauthorized Data Modification

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

CVE-2026-92567 TDuck survey form through 5.0 Unauthorized Data Modification

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

EUVD-2026-80813

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...