rapid7

CVE-2026-81178: Syslifters sysreptor: SysReptor is a fully customizable pentest reporting platform

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the ...
rapid7

CVE-2026-93871: Cotonti: Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing…

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary ...
rapid7

CVE-2026-87105: Improper Neutralization of Special Elements used in an SQL Command

CVSS 3.1 Base Score: 8.8 CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) With curated Threat Intelligence, you can see which vulnerabilities truly put ...
rapid7

CVE-2026-82967: IBM Guardium Data Protection: IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote…

IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management ...
rapid7

CVE-2026-93736: mealie-recipes mealie: Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated…

Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary ...
rapid7

CVE-2026-80442: IBM Guardium Data Protection: IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the…

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to ...
rapid7

CVE-2026-89031: Authorization Bypass Through User-Controlled Key

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php ...
rapid7

CVE-2026-92126: Jenkins Project Jenkins Script Security Plugin: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose…

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to ...
rapid7

CVE-2026-40530: Synology DiskStation Manager (DSM): An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation…

An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote ...
rapid7

CVE-2026-90044: Undefined Security Weakness

In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is freed. However ...
rapid7

CVE-2026-84073: IBM Guardium Data Protection: IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements ...
rapid7

CVE-2026-90884: brechtvds WP Recipe Maker: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all…

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and ...