|
2131
|
- |
|
-
|
-
|
Lack of input filtering leads to an XSS vector in the HTML filter code.
|
CWE-79
Cross-site Scripting
|
CVE-2026-48905
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2132
|
- |
|
-
|
-
|
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
|
CWE-284
Improper Access Control
|
CVE-2026-48904
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2133
|
- |
|
-
|
-
|
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
|
CWE-79
Cross-site Scripting
|
CVE-2026-48903
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2134
|
- |
|
-
|
-
|
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
|
CWE-284
Improper Access Control
|
CVE-2026-48900
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2135
|
- |
|
-
|
-
|
An improper access check allows privilege escalation through the com_users batch task.
|
CWE-284
Improper Access Control
|
CVE-2026-48899
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2136
|
- |
|
-
|
-
|
An improper access check allows privilege escalation through the com_users batch task.
|
CWE-284
Improper Access Control
|
CVE-2026-48898
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2137
|
- |
|
-
|
-
|
Rejected reason: Further research determined the issue is not a vulnerability.
|
-
|
CVE-2026-48091
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2138
|
4.3 |
MEDIUM
Network
|
-
|
-
|
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An a…
|
CWE-862
Missing Authorization
|
CVE-2026-47728
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2139
|
3.1 |
LOW
Network
|
-
|
-
|
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the …
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-47716
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2140
|
3.1 |
LOW
Network
|
-
|
-
|
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requir…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-47715
|
2026-05-27 02:16 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|