Threat Intelligence Database

CVE-2026-115998 is an Insecure Direct Object Reference (IDOR) vulnerability in CervantesSec cervantes version v1.3-beta. It allows an authenticated attacker to access sensitive data such as findings, proof-of-concept details, credentials, and client information from projects they do not belong to. The attacker can also modify finding statuses and transfer findings to their own projects, impacting data confidentiality and integrity.

CVE-2026-114194 is a reflected cross-site scripting (XSS) vulnerability in the Igor Funa Ad Inserter plugin. It affects versions from initial releases up to 2.8.18. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute malicious scripts in the context of a user's browser session. The CVSS score is 6.5, indicating a medium severity level.

CVE-2026-115994 is an authorization bypass vulnerability in CervantesSec cervantes version v1.3-beta. It allows an attacker with limited privileges to modify or delete targets belonging to other projects without proper authorization. This compromises the integrity of penetration testing scopes, results, and associated security reports. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

CVE-2026-115993 is a stored cross-site scripting (XSS) vulnerability in the Notes field of the Checklists feature in Cervantes version v1.3-beta. This flaw allows an attacker to inject malicious scripts that execute in another user's browser with elevated privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation information is currently available, and there are no known exploits in the wild.

Cloudflare has introduced a post-quantum (PQ) GeoKey Manager that restricts decryption keys to be unwrapped only within designated geographic regions. This system uses hybrid post-quantum cryptography (ML-KEM-768 plus X25519) to protect keys, ensuring that regional root keys never leave their authorized regions and are stored only in volatile kernel memory on authorized edge servers. The GeoKey Manager supports data sovereignty by enforcing geographic boundaries on key usage, preventing decryption outside the chosen region. It is currently in closed beta with general availability planned for Q1 2027.

CVE-2026-114196 is a critical deserialization of untrusted data vulnerability in paytiumsupport Paytium affecting versions from initial through 5.0.5. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation information is currently provided.

CVE-2026-114695 is a stored cross-site scripting (XSS) vulnerability in Infomaniak Network's VOD Infomaniak product. It affects versions from initial releases up to 1.5.14. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This can lead to partial confidentiality, integrity, and availability impacts. The vulnerability has a high severity score of 7.1 but no known exploits in the wild have been reported. No vendor patch or official fix information is provided in the available data.

CVE-2026-114694 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in Pixelite Events Manager affecting versions from initial releases up to 7.4.8. This flaw involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The vulnerability has a CVSS 3.1 score of 7.1, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

CVE-2026-114693 is a stored cross-site scripting (XSS) vulnerability in Plugins360 Labs All-in-One Video Gallery affecting versions before 5.0.0. It allows improper neutralization of input during web page generation, potentially leading to script injection. The vulnerability has a medium severity with a CVSS score of 6.5. A patch is available, and the product is a cloud-hosted service, so the vendor manages remediation.

CVE-2026-110892 is a missing authorization vulnerability in Brainstorm Force SureDash versions before 1.12.3. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. It affects SureDash versions from initial releases up to 1.12.2 inclusive.