6.8
CVE-2025-7708 - Sensitive Data Exposure in Atlas Software's k12net
Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulation.This issue affects k12net: through 09022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
5.1
CVE-2026-1960 - Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes
Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.
5.1
CVE-2026-1959 - Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes
Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'descripción' parameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoint.
5.4
CVE-2026-0632 - Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery vi…
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.12 via the 'saveDataSource' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbi…
9.8
CVE-2025-6830 - SQLi in Xpoda Türkiye Information Technology's Xpoda Studio
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Xpoda Studio allows SQL Injection.This issue affects Xpoda Studio: through 09022026. NOTE: The vendor was contacted early about this disclosure but did not…
9.1
CVE-2026-25848 -
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
8.2
CVE-2026-25847 -
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
6.5
CVE-2026-25846 -
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
6.5
CVE-2026-22922 - Apache Airflow: Airflow externalLogUrl Permission Bypass
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this is…
6.5
CVE-2026-24098 - Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors
Apache Airflow versions before 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue