CVE-2026-46511

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...

EUVD-2026-34890

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...

VulnCheck KEV: CVE-2026-31816

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: dask-gateway, haproxy-ingress, rook, cert-exporter, cis-operator, flux, mountpoint-s3-csi-driver, argocd-image-updater, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, polaris, kots, vertical-pod-autoscaler, cluster-api-ipam-provider-in-cluster, ranche...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: dask-gateway, haproxy-ingress, rook, cert-exporter, cis-operator, flux, mountpoint-s3-csi-driver, argocd-image-updater, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, polaris, kots, vertical-pod-autoscaler, cluster-api-ipam-provider-in-cluster, ranche...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, buildah, dask-gateway, haproxy-ingress, rook, cert-exporter, ksops, cis-operator, flux, mountpoint-s3-csi-driver, pulumi-language-java, tetragon, argocd-image-updater, cri-tools, crossplane-provider-aws-firehose, crossplane-provider-aws-sns,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, buildah, dask-gateway, haproxy-ingress, rook, cert-exporter, ksops, cis-operator, flux, mountpoint-s3-csi-driver, nri-postgresql, pulumi-language-java, tetragon, argocd-image-updater, cri-tools, crossplane-provider-aws-firehose,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, buildah, dask-gateway, haproxy-ingress, rook, cert-exporter, ksops, cis-operator, flux, mountpoint-s3-csi-driver, pulumi-language-java, tetragon, argocd-image-updater, cri-tools, crossplane-provider-aws-firehose, crossplane-provider-aws-sns,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, buildah, dask-gateway, haproxy-ingress, rook, cert-exporter, ksops, cis-operator, flux, mountpoint-s3-csi-driver, nri-postgresql, pulumi-language-java, tetragon, argocd-image-updater, cri-tools, crossplane-provider-aws-firehose,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, crossplane-provider-aws-firehose, cloud-provider-gcp-cloud-controller-manager-fips, addon-resizer,...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, crossplane-provider-aws-firehose, cloud-provider-gcp-cloud-controller-manager-fips, addon-resizer,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, amazon-k8s-cni, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, crossplane-provider-aws-firehose, terraform-provider-random-fips,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, amazon-k8s-cni, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, crossplane-provider-aws-firehose, terraform-provider-random-fips,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, amazon-k8s-cni, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, crossplane-provider-aws-firehose, terraform-provider-random-fips,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, amazon-k8s-cni, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, crossplane-provider-aws-firehose, terraform-provider-random-fips,...

PT-2026-46853

Summary plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance without...

CVE-2026-10273

A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit h...

CVE-2026-10617

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-10617

The CVE-2026-10617 entry describes a vulnerability in nextlevelbuilder GoClaw up to version 3.11.3, affecting the resolveAuth function in internal/http/auth.go of the Webhook Verification Handler. The issue results from a manipulation that leads to missing authentication, enabling remote exploita...