CVE ID :CVE-2026-106700 Published : Oct. 15, 2026, 8:17 p.m. | 34 minutes ago Description :ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied…
CVE ID :CVE-2026-106708 Published : Oct. 15, 2026, 8:17 p.m. | 34 minutes ago Description :XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection…
CVE ID :CVE-2026-57496 Published : Oct. 15, 2026, 7:17 p.m. | 1 hour, 34 minutes ago Description :NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the…
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week’s security stories. The rest gets interesting in different ways. A…
CVE ID :CVE-2026-84731 Published : Oct. 15, 2026, 6:17 p.m. | 33 minutes ago Description :An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP…
CVE ID :CVE-2026-55103 Published : Oct. 15, 2026, 6:17 p.m. | 33 minutes ago Description :Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request…
CVE ID :CVE-2026-55240 Published : Oct. 15, 2026, 6:15 p.m. | 35 minutes ago Description :Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src passes survey feedTemplate and monitor notification templates to…
CVE ID :CVE-2026-55239 Published : Oct. 15, 2026, 6:14 p.m. | 36 minutes ago Description :Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src constructs raw SQL through Prisma.sql() by…
CVE ID :CVE-2026-108335 Published : Oct. 14, 2026, 9:39 p.m. | 8 minutes ago Description :When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting…
CVE ID :CVE-2026-71854 Published : Oct. 14, 2026, 9:17 p.m. | 30 minutes ago Description :OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default…