PT-2026-98041

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ASOC rockchip rockchip pdm component, the rockchip pdm set fmt function calls pm runtime get sync before accessing hardware registers but fails to check the return value. If the...

automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

GHSA-W998-QMW9-MF4M REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

Summary The mediapool sync page sync.php renders filenames from the /media filesystem directory directly into HTML without applying rexescape i.e., htmlspecialchars. Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any...

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

Summary The mediapool sync page sync.php renders filenames from the /media filesystem directory directly into HTML without applying rexescape i.e., htmlspecialchars. Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering of unescaped filenames from the filesystem in the backend sync page. An attacker can execute arbitrary JavaScript in the browser of backend users by placing specially crafted files with malicio...

CVE-2026-63002 REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

CVE-2026-63002 REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

EUVD-2026-85331

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

CVE-2026-95676

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply...

CVE-2026-95676 AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply...

CVE-2026-95676 AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply...

CVE-2026-95676

The WatchGuard AuthPoint Gateway is susceptible to a missing/improper authentication vulnerability within its LDAP Sync first-factor authentication mechanism. Under non-default operating conditions, a remote attacker can bypass single-factor password verification. However, the impact is limited a...

EUVD-2026-85287

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply...

WordPress Social Commerce for WooCommerce plugin <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update vulnerability

Unauthenticated Plugin Option and Product Sync Status Update vulnerability discovered by Pablo González, Fran Ramirez and Iñigo Sánchez in WordPress Plugin Social Commerce for WooCommerce versions = 2.5.4...

CVE-2026-95676: Improper Authentication

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply...

PT-2026-97330

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.2 Description REDAXO is a PHP-based content management system. The Mediapool Sync page, located at the endpoint redaxo/src/addons/mediapool/pages/sync.php, fails to apply the rex escape function which performs HTM...

PT-2026-97314

Name of the Vulnerable Software and Affected Versions WatchGuard AuthPoint Gateway affected versions not specified Description An improper authentication issue exists in the LDAP Sync first-factor authentication. This allows a remote attacker to bypass single-factor password verification when the...

CVE-2026-58269

creationtimestamp| type| source ---|---|--- 2026-09-22 16:35:11+00:00| published-proof-of-concept| https://github.com/Sync-in/server/security/advisories/GHSA-92cr-jxw4-5wjg...

CVE-2026-58270

creationtimestamp| type| source ---|---|--- 2026-09-22 16:35:08+00:00| published-proof-of-concept| https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph 2026-09-22 19:32:27+00:00| seen| https://gist.github.com/alon710/b536815814568f1fe4f87321daa1216e...

CVE-2026-58272

creationtimestamp| type| source ---|---|--- 2026-09-22 16:31:56+00:00| seen| https://gist.github.com/alon710/0d291d38492cd0f426b608e184326562 2026-09-22 16:35:04+00:00| published-proof-of-concept| https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47...