SUSE CVE-2026-64621

FreeRDP before 3.28.0 affected 3.x through 3.27.1 contains a double-free vulnerability in freerdpclientrdpfileapplytosettings client/common/file.c when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning...

BIT-PARSE-2021-47986 Parse Server - Unreviewed Code Execution via Malicious Version Tags

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and...

CVE-2026-15227 Missing Authorization Allows Editing of Foreign Reports

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

CVE-2026-15227

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

CVE-2026-15227 Missing Authorization Allows Editing of Foreign Reports

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

CVE-2026-14554

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...

WordPress wpForo Forum plugin < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion vulnerability

Subscriber+ Cross-User AI Chat Message Deletion vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin wpForo Forum versions 3.1.2...

WordPress ElementsKit Elementor Addons plugin < 3.10.01 - Subsite Administrator+ Stored XSS vulnerability

Subsite Administrator+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ElementsKit Elementor addons Lite versions 3.10.01...

CVE-2026-15381

The WP Go Maps WordPress plugin (versions prior to 10.1.04 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the improper sanitization and escaping of a parameter before its use in a SQL query , specifically identified in the Markers REST filter . This flaw allows an e...

CVE-2026-14927 FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-63221

CodeIgniter (PHP) 4.x contains a SQL injection in the Query Builder deleteBatch() path from 4.3.0–4.7.3. When used with where() conditions, deleteBatch() substitutes bound values into generated SQL and ignores escape flags, allowing user-controlled values to be interpreted as SQL. The issue does ...

CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

EUVD-2026-51372

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enfor...

EUVD-2026-51371

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-a...

SUSE CVE-2026-4286

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to check if teamid was being changed when updating playbooks, allowing users with only Manage Playbook Configurations permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID:...

SUSE CVE-2026-6346

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in...

PT-2026-66856

Name of the Vulnerable Software and Affected Versions TR1200 version 2.4.15 TR3000 version 2.4.21 WR300 version 2.4.25 WR1200 version 2.4.23 WR1300 version 2.4.22 WR1500 version 2.3.10 WR3000 version 2.4.19 WR3600 version 2.3.16 WR6500 version 2.3.15 Description A command injection issue exists i...

PT-2026-66752

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p10 Checkmk versions prior to 2.4.0p35 Checkmk versions prior to 2.3.0p49 Checkmk version 2.2.0 Description An authorization flaw allows an authenticated user who does not possess the "Edit foreign Reports"...

CVE-2026-38711

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.upgradecheck interface. This vulnerability allows attackers to execute...

EUVD-2026-51647

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary...