CVE-2026-109610: Missing Authorization

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

PT-2026-110436

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description A flaw in the Biometric Data Endpoint component affects the /iclock/finger data/ endpoint. A remote attacker can achieve authorization bypass by manipulating the emp code argument...

CVE-2026-109658: Missing Authorization

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits...

PT-2026-110673

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.10.0 through 3.32.2 Description A heap buffer overflow occurs in the WinPR png write data callback when a realloc failure happens. A malicious RDP clipboard peer can trigger an out-of-bounds memcpy during PNG conversion by...

PT-2026-110733

Name of the Vulnerable Software and Affected Versions Grav Data Manager plugin versions 1.4.0 through 1.4.5 Description Missing authorization allows unauthenticated attackers to delete stored data files through the classic Admin integration. By sending a request containing the delete parameter...

PT-2026-110471

Name of the Vulnerable Software and Affected Versions y project RuoYi versions prior to 4.8.4 Description A remote cross site scripting issue exists in the Dictionary Data Drawer Preview component. The problem occurs within the renderDrawer function located in the /system/dict/data/add file. An...

PT-2026-111057

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.0 Frappe ERPNext versions 16.x prior to 16.31.0 Description Certain endpoints fail to enforce proper authorization checks on valuation data. This allows authenticated low-privileged users to query these...

PT-2026-111082

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.110.0 Frappe ERPNext versions 16.x prior to 16.21.0 Description Certain endpoints fail to enforce proper authorization checks during record status changes. This allows authenticated low-privileged users to...

ROS-20261012-73-0043

The vulnerability of the cgroupmigrateaddtask function in the kernel/cgroup/cgroup.c module of the Linux operating system is related to incorrect handling of highly compressed input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-110814

Name of the Vulnerable Software and Affected Versions Quarkus REST Data Panache affected versions not specified Description Quarkus REST Data Panache automatically generates REST endpoints for data entities. A flaw exists where certain endpoints fail to properly validate the sort parameter provid...

CVE-2026-109180: Authorization Bypass Through User-Controlled Key

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...

PT-2026-110571

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An incorrect authorization issue exists in the GET '/supplier/exportExcel' endpoint. This allows authenticated users to bypass role data scope restrictions that are normally enforced by the...

CVE-2026-109182: Incorrect Authorization

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109627: Missing Authorization

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-85956: Improper Privilege Management

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or...

CVE-2026-21133: Undefined Security Weakness

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...

Cisco NX-OS Data Compromise

The vulnerability of the Cisco NX-OS operating system is related to insufficient checks for data message or data structure correctness. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

CVE-2026-109670: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

CVE-2026-109643: Missing Authorization

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned...

CVE-2026-109613: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...