Threat database

CVE-2026-83589 is an open redirect vulnerability in the oauth-proxy component of Red Hat OpenShift Container Platform 4.14. The flaw allows improper validation of the destination redirect parameter during post-login redirection. An attacker can craft a link that redirects authenticated users to arbitrary external websites, potentially enabling phishing or credential theft attacks. The vulnerability requires user interaction and affects the trusted authentication gateway of OpenShift clusters.

CVE-2026-103431 is a vulnerability in colmux component of collectl before version 4.3.20.3. It involves improper sanitization of ANSI/VT100 terminal escape sequences in data received from remote collectl instances. This allows a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux by crafting a malicious process name (argv[0]). The vulnerability has a high severity with a CVSS score of 7.7.

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

CVE-2026-103494 is a privilege escalation vulnerability in JetBrains YouTrack versions before 2026.2.19422. The issue arises from improper control over user group membership changes, allowing users with certain privileges to escalate their access rights. The vulnerability has a CVSS score of 6.6, indicating a medium severity level.

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

CVE-2026-103490 is a privilege escalation vulnerability in JetBrains YouTrack versions prior to 2026.2.19422. The issue arises from improper access control related to user group links, classified under CWE-862. This vulnerability allows users with certain privileges to escalate their access rights, potentially leading to full control over the affected system. The vulnerability has a high severity rating with a CVSS score of 7.2. No known exploits are reported in the wild, and no official patch links are provided in the input data.

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

A security researcher reported a vulnerability on Agoda's main domain following the instructions in Agoda's security.txt file, which at the time listed an email contact. The researcher received no acknowledgment for 28 days. Later, Agoda's security.txt was updated to point to a HackerOne bug bounty program, where the report was closed as a duplicate of an earlier submission. The researcher experienced unclear guidance from HackerOne about reporting issues on domain paths outside the program's listed scope, leading to confusion and delayed remediation.

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways.

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver the payload.

The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin up to version 2.8.18 is vulnerable to reflected cross-site scripting (XSS) via the 's' search parameter. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires that a site administrator has configured an Ad Inserter block using the {title} or {short-title} placeholder enabled on search pages. An attacker can inject arbitrary scripts that execute when a user clicks a crafted link. The vulnerability has a medium severity with a CVSS score of 6.1.

The Form Maker by 10Web WordPress plugin up to version 1.15.47 is vulnerable to a stored cross-site scripting (XSS) flaw via the Mark on Map Longitude/Latitude fields. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view affected pages. The issue arises from insufficient input sanitization and output escaping.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to a reflected DOM-based cross-site scripting (XSS) attack via a parameter that matches the form's url.<name> predefined value. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. Exploitation requires the targeted form to have a Text Area field configured with a 'url.<name>' predefined value and predefinedClick disabled, which is a common plugin feature.

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.

The WPC Shop as a Customer for WooCommerce WordPress plugin contains a privilege escalation vulnerability allowing authenticated users to impersonate any Administrator without needing their password. This affects all versions up to and including 2.0.0. The flaw arises from improper validation of the target user's role before issuing a new authentication session, enabling session takeover and full Administrator access.