CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

CVE-2026-16800

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

CVE-2026-16798

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

CVE-2026-66004 BlenderMCP Path Traversal via download_polyhaven_asset API

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

...

CVE-2026-58630 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability

...

CVE-2026-57106 Data Quality Elevation of Privilege Vulnerability

...

CVE-2026-8308 Reflected XSS Polen Media's Website Template

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...

CVE-2026-17059 Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

CVE-2026-55731 Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

CVE-2026-55730 Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

CVE-2026-55729 Loytec LWEB802: Exposure of Sensitive Information in browser localStorage

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55728 Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict

Stack-based Buffer Overflow CWE-121 in /usr/bin/ltsudo cmdipaddrconflict in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly lo...

CVE-2026-12504 Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-12503 Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter

Improper Link Resolution CWE-59 in /usr/bin/larmstarter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group leading to root privilege escalation via a symlink attack on...

CVE-2026-12502 Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo

Improper Privilege Management CWE-269 in /usr/bin/ltsudo in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to reset the password of any LARM user including the larmapp service account via the set-passwd...

CVE-2026-12496 Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

CVE-2026-7007 Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock subsys/fs/ext2/ext2impl.c before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and...

CVE-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-16743 Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...

CVE-2026-7484 Improper Access Control in Abis Technology's AVESİS

External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...

CVE-2026-9765 CVE-2026-9765 CVE Record

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized acce...

CVE-2026-46452 Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

CVE-2026-45816 Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts otherwise assert would trigger before NULL dereference and bogus or misbehaving controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are...

CVE-2026-45815 Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

CVE-2026-45813 Apache NimBLE: Incorrect data validation in BASS add/modify source operation

Out-of-bounds Write, Integer Underflow Wrap or Wraparound vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearb...

CVE-2026-45812 Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...

CVE-2026-45811 Apache NimBLE: Buffer overflow in socket HCI transport

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...

CVE-2026-66144 Apache Neethi: Remote PolicyReference fetch lacks resource bounds

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

CVE-2026-66010 DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66143 Apache Neethi: Missing global alternative-output budget across policy computation paths

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-15243 Improper Validation of Certificate in CAS Client

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-16730 Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably SOPEERPIDFD are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and den...

CVE-2026-10610 Local privilege escalation in ESET security applications for macOS

Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user...

CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-7483 Local privilege escalation in ESET security applications for macOS

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

CVE-2026-15663 Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-10033 EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...

CVE-2026-15401 VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-16634 TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to fromtoml risks a stack...

CVE-2026-12702

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

CVE-2026-24727 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-63317 Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-15346 VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-15739 Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-15821 SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...