EUVD-2026-91464

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the deletetag parameter via top-level navigation, carrying the...

CVE-2026-104453 YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the deletetag parameter via top-level navigation, carrying the...

PT-2026-104263

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete tag parameter via top-level navigation, carrying the...

RabbitMQ 4.0.x < 4.0.22 / 4.1.x < 4.1.14 / 4.2.x < 4.2.7 / 4.3.x < 4.3.1 Atom Exhaustion via Global Parameter Name

The version of RabbitMQ installed on the remote host is 4.0.x prior to 4.0.22, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.7, or 4.3.x prior to 4.3.1. It is, therefore, affected by a denial of service vulnerability: - resourceexists/2, and the PUT and DELETE handlers, call...

PT-2026-104396

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-63374 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-63374 Source advisory: OSV:PYSEC-2026-4025...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-64847 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

CVE-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

BIT-RABBITMQ-2026-67420 RabbitMQ OAuth credential refresh retains revoked runtime tags

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

BIT-RABBITMQ-2026-67233 RabbitMQ: Monitoring-tag user can DELETE shovels

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's isauthorized/2 delegates to rabbitmgmtutil:isauthorizedmonitor/2, which accepts the monitoring tag. But allowedmethods includes DELETE, and deleteresource/2...

BIT-RABBITMQ-2026-67218 RabbitMQ: Super-stream HTTP creation skips configure-permission check

RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, acceptcontent/2 at line 56 calls rabbitstreammanager:createsuperstream/... directly after isauthorized which only checks the management tag + vhost access via isauthorizedvhost. The stream-protocol...

BIT-RABBITMQ-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

BIT-RABBITMQ-2026-66078 RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

BIT-RABBITMQ-2026-66075 RabbitMQ: Monitoring-tag user can restart federation links

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...

CVE-2026-103662

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662

A reflected cross-site scripting (XSS) vulnerability exists in the MISP legacy taxonomy tag management confirmation forms (specifically the add tag and disable tag forms). The flaw is caused by the application echoing a user-supplied tag name value from the request into the rendered HTML output w...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

EUVD-2026-90577

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...