Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-9748

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9747

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9746

When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9743

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affec

PUBLISHED
Vendor
MongoDB
Product
MongoDB server
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9742

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH
Conflicts
1

CVE-2026-9741

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9740

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH
Conflicts
1

CVE-2026-9739

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.

PUBLISHED
Vendor
Google
Product
MCP Toolbox for Databases
Provider severity
CRITICAL
Conflicts
0

CVE-2026-9738

The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versions up to, and including, 5.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED
Vendor
printfriendly
Product
Print, PDF & Email by PrintFriendly
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9735

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9734

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's Zoho CRM integration settings, replacing the configured data center, client ID, client secret, and user email credentials with attacker-controlled values via a forged request granted they can trick a sit

PUBLISHED
Vendor
w3scloud
Product
W3SC Elementor to Zoho CRM
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9733

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).

PUBLISHED
Vendor
HAYAJO
Product
Mojolicious::Plugin::Web::Auth::OAuth2
Provider severity
CRITICAL
Conflicts
1

CVE-2026-9732

The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the form_settings_ui (settings save handler, procedural include scope) function. This makes it possible for unauthenticated attackers to modify plugin settings including the minimum access role (altering WordPress role capabilities via add_cap/remove_cap), the data-erasure-on-

PUBLISHED
Vendor
planetshaker
Product
EmergencyWP – Dead Man's switch & legacy deliverance
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9731

The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce validation on the plugin_settings function. This makes it possible for unauthenticated attackers to update the plugin's notification text and CSS settings (wp_non_js_notification_text and wp_non_js_notification_css), injecting arbitrary content that is echoed unescaped on the frontend via a forged request granted they can trick a

PUBLISHED
Vendor
wpkuf
Product
Wp Js Detect
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9730

The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the gmz_comment_settings_save function. This makes it possible for unauthenticated attackers to modify the plugin's comment-display setting via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PUBLISHED
Vendor
jamesmuga
Product
Remove NoFollow Commenter URL
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9729

The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notification_body' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the save_send_notification_flag() function and missing output escaping in the wpp_notification_box() function, which concatenates raw post meta values directly into HTML attribute and textarea contexts. This makes it possible fo

PUBLISHED
Vendor
webpushr
Product
Web Push Notifications – Webpushr
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9726

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

PUBLISHED
Vendor
Drupal
Product
Drupal AlternativeCommerce (Basket)
Provider severity
CRITICAL
Conflicts
0

CVE-2026-9725

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP'

PUBLISHED
Vendor
printcart
Product
Printcart Web to Print Product Designer for WooCommerce
Provider severity
CRITICAL
Conflicts
0

CVE-2026-9724

The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the motordesk_admin_home function. This makes it possible for unauthenticated attackers to update the plugin's configuration settings, including the search page URI and custom template directory path via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PUBLISHED
Vendor
motordesk
Product
MotorDesk
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9723

The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.2. This is due to missing or incorrect nonce validation on the googlePlusOneAdmin function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the plusone-lang, plusone-callback, and plusone-url options stored in the database via a forged request granted they can trick a site administrator into performing an action such

PUBLISHED
Vendor
ddd2500
Product
Google Plus One Bottom
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9722

The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the addOptionsPageFields function. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, tag blacklist, relevance threshold, batch size, and tagging toggles, via a forged request via a forged request granted they can trick a site administrator into performing an a

PUBLISHED
Vendor
pcis
Product
Laiser Tag
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9721

The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the settings_form()/update_settings() functionality. The plugin's options page handler dispatches on the 'action' POST parameter and calls update_settings(), which persists plugin configuration (including the external database host, username, password, prefix, database name, encryption key, and registrat

PUBLISHED
Vendor
chuhpl
Product
Book a Room Event Calendar
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9720

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the (global scope, included by fvcr_admin_page_html) function. This makes it possible for unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and bran

PUBLISHED
Vendor
facturadorvirtual
Product
Facturación Electrónica Costa Rica
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9719

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the change_status function. This makes it possible for unauthenticated attackers to change the status of arbitrary invoices — including marking unpaid invoices as paid — without administrator consent via a forged request granted they can trick a site administrator i

PUBLISHED
Vendor
latepoint
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9718

CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a specially crafted request is sent to a vulnerable network-exposed service.

PUBLISHED
Vendor
Schneider Electric
Product
PowerLogic™ P7
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9717

CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts with a vulnerable network-exposed service.

PUBLISHED
Vendor
Schneider Electric
Product
PowerLogic™ P7
Provider severity
HIGH
Conflicts
0

CVE-2026-9716

CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionality unavailable when malformed requests are received over exposed network interfaces.

PUBLISHED
Vendor
Schneider Electric
Product
PowerLogic™ P7
Provider severity
HIGH
Conflicts
0

CVE-2026-9714

The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortcode in versions up to, and including, 1.2 This is due to insufficient input sanitization and output escaping in the showmodule_shortcode() function, which concatenates the 'id' shortcode attribute directly into a dynamically constructed shortcode string without applying esc_attr() or any escaping, allowing an attacker to break out of the attribute context a

PUBLISHED
Vendor
creaweb2b
Product
Simple Divi Shortcode
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9713

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is int

PUBLISHED
Vendor
King-Theme
Product
Product Designer for WooCommerce WordPress | Lumise
Provider severity
HIGH
Conflicts
0

CVE-2026-9712

When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places in pretix when temporary files are generated for internal use or download. One remaining API endpoint, however, wrongfully did not verify if the UUID used for download actually belongs to a

PUBLISHED
Vendor
pretix
Product
pretix
Provider severity
LOW
Conflicts
0

CVE-2026-9711

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted the "

PUBLISHED
Vendor
EventON
Product
EventON (Pro) - WordPress Virtual Event Calendar Plugin
Provider severity
CRITICAL
Conflicts
0

CVE-2026-9710

The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Corner

PUBLISHED
Vendor
Unknown
Product
Cornerstone
Provider severity
HIGH
Conflicts
0

CVE-2026-9709

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository.

PUBLISHED
Vendor
Unknown
Product
Cornerstone
Provider severity
HIGH
Conflicts
0

CVE-2026-9708

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direct messages attributed to another user via crafted incoming webhook configuration and payloads.. Mattermost Advisory ID: MMSA-2026-00683

PUBLISHED
Vendor
Mattermost
Product
Mattermost
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9705

A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6.4, Red Hat build of Keycloak 26.6
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9704

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.3, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9702

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

PUBLISHED
Vendor
Unknown
Product
InPost PL
Provider severity
HIGH
Conflicts
0

CVE-2026-9701

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it

PUBLISHED
Vendor
joe007
Product
Eventer
Provider severity
CRITICAL
Conflicts
0

CVE-2026-9700

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PUBLISHED
Vendor
joe007
Product
Eventer
Provider severity
HIGH
Conflicts
0

CVE-2026-9699

Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609

PUBLISHED
Vendor
Mattermost
Product
Mattermost
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9698

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, HMBRAND
Product
Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, DBI
Provider severity
HIGH
Conflicts
3

CVE-2026-9697

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, undici, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
OpenShift Pipelines, Red Hat Build of Podman Desktop, Red Hat OpenShift AI (RHOAI), Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI), Cluster Observability Operator 1.5.0, Red Hat Enterprise Linux 10, Cluster Observability Operator 1.5.0, Red Hat OpenShift Dev Spaces 3.29, Red Hat OpenShift AI (RHOAI), Red Hat AMQ Broker 7, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 10, Red Hat Openshift Data Foundation 4, Red Hat Enterprise Linux 9, Red Hat Developer Hub 1.9, Red Hat Hardened Images, Cluster Observability Operator 1.5.0, Cluster Observability Operator 1.5.0, Red Hat OpenShift Container Platform 4, Red Hat OpenShift AI (RHOAI), Red Hat Developer Hub 1.10, Self-service automation portal 2, Red Hat Openshift Data Foundation 4, Red Hat Openshift Data Foundation 4, Cryostat 4, Red Hat OpenShift Dev Spaces 3.29, Red Hat Enterprise Linux 9, OpenShift Pipelines, Red Hat OpenShift Dev Spaces 3.29, Cryostat 4, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 8, Cluster Observability Operator 1.5.0, Red Hat OpenShift AI (RHOAI), undici, Red Hat OpenShift Container Platform 4.16, Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Cluster Observability Operator 1.5.0, Cluster Observability Operator 1.5.0, Red Hat OpenShift Dev Spaces 3.29, Cryostat 4 on RHEL 9, Cluster Observability Operator 1.5.0, OpenShift Pipelines, Red Hat OpenShift Container Platform 4, Self-service automation portal 2, Cluster Observability Operator 1.5.0, Red Hat Hardened Images
Provider severity
HIGH
Conflicts
3

CVE-2026-9695

An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.

PUBLISHED
Vendor
Dassault Systèmes
Product
DELMIA Apriso
Provider severity
CRITICAL
Conflicts
0

CVE-2026-9694

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary content via a specially crafted Service Desk email reply due to improper neutralization in email template processing.

PUBLISHED
Vendor
GitLab
Product
GitLab
Provider severity
LOW
Conflicts
0

CVE-2026-9692

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.

PUBLISHED
Vendor
HAYAJO
Product
Mojolicious::Sessions::Storable
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9691

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

PUBLISHED
Vendor
CRM Perks
Product
Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms
Provider severity
CRITICAL
Conflicts
0

CVE-2026-9690

Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.

PUBLISHED
Vendor
Joomunited
Product
WP Media folder Addon
Provider severity
HIGH
Conflicts
0

CVE-2026-9689

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to b

PUBLISHED
Vendor
Red Hat
Product
Red Hat Build of Keycloak
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9680

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

PUBLISHED
Vendor
Alibaba
Product
Alibaba Cloud RDS OpenAPI MCP Server
Provider severity
MEDIUM
Conflicts
0