CVE Notifier

CVE-2026-81235 CWE-325 8.0

CVE-2026-81235

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Infor…

cve.org Dell:Wyse · Management · Suite 15 Sep 2026

CVE-2026-11728 CWE-787 8.1

IBM MQ .NET client is vulnerable to remote code execution

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote att…

cve.org IBM:MQ 15 Sep 2026

CVE-2026-56831 CWE-20 6.5

Shopper: Negative discount values accepted and propagated through order calculation pipeline

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/sh…

cve.org shopperlabs:shopper 15 Sep 2026

CVE-2026-56827 CWE-862 8.1

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pag…

cve.org shopperlabs:shopper 15 Sep 2026

CVE-2026-81240 CWE-434 8.6

CVE-2026-81240

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerab…

cve.org Dell:Wyse · Management · Suite 15 Sep 2026

CVE-2026-56829 CWE-862 8.1

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant …

cve.org shopperlabs:shopper 15 Sep 2026

CVE-2026-18115 CWE-862 N/A

In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). A user with an…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-56825 CWE-862 8.1

Shopper: Missing authorization on product removal actions in CollectionProducts component

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collection…

cve.org shopperlabs:shopper 15 Sep 2026

CVE-2026-58502 CWE-78 N/A

githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Ba…

cve.org gouef:githubtoplanguages 15 Sep 2026

CVE-2026-81239 CWE-434 8.6

CVE-2026-81239

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerab…

cve.org Dell:Wyse · Management · Suite 15 Sep 2026

CVE-2026-12910 CWE-306 5.4

Missing Authentication for Critical Function in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass S…

cve.org GitLab:GitLab 15 Sep 2026

CVE-2026-13210 CWE-863 7.7

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access C…

cve.org GitLab:GitLab 15 Sep 2026