PT-2026-87170

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator ...

EUVD-2026-72848

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...

CVE-2026-86500

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

CVE-2026-86500

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

CVE-2026-86500

In JetBrains YouTrack versions prior to 2026.1.14047 , a missing escalation check allowed a user with project update permissions to grant themselves Project Admin rights, effectively elevating their access beyond the intended permission level. The underlying cause is the absence of a proper check...

EUVD-2026-72516

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

CVE-2026-86500

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

CVE-2026-12853

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

Exploit for Improper Authentication in Jfrog Artifactory

CVE-2026-82329-JFrog-Artifactory- CVE-2026-82329 — JFrog Arti...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-76578

FreeIPA is affected by a critical flaw (CVSS 9.8 ) in its self-managed OTP token ACI , which does not require authentication and fails to restrict which attributes may be added alongside a token entry. Combined with a related flaw in the underlying directory server's ACI evaluation (tracked separ...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier vulnerability

Unauthenticated Account Takeover via 'acfobjects' Object Identifier vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...

PT-2026-86872

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

Linux Distros Unpatched Vulnerability : CVE-2026-86090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users ca...

PT-2026-86757

Name of the Vulnerable Software and Affected Versions FreeIPA versions prior to 4.13.4 Description A flaw exists in the self-managed OTP token Access Control Instruction ACI, which does not require authentication and fails to restrict the attributes that can be added alongside a token entry. An...

Linux Distros Unpatched Vulnerability : CVE-2026-86091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools an...

PT-2026-86917

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-86500: Incorrect Privilege Assignment

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

PT-2026-86751

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...