PT-2026-95156

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An authorization bypass exists in the GDPR tools located in the admin/sources/customers.gdpr.inc.php file. The system relies on page-level CC PERM READ access and fails to require CC PERM DELETE for...

PT-2026-95145

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description An issue exists where the getThemeFolder function in admin/controller/editor/revisions.php returns the theme parameter without proper sanitization. The backupFolder function then concatenates this...

PT-2026-95153

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists where the file 'admin/sources/products.index.inc.php' reads rich-text fields from the $GLOBALS'RAW''POST' variable and only removes script elements before storing and rendering them...

PT-2026-94424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fq init function where quantum and initial quantum are computed using psched mtu without overflow checks. When a device has an excessively large Maximum Transmissi...

PT-2026-95151

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An authenticated administrator without order modification privileges can delete order-history notes, which removes operational records and audit-trail data. This occurs because the delete-note handl...

PT-2026-94422

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A signed overflow occurs in the fq pie init function when the default quantum is set using psched mtu without clamping. On devices with an exceptionally large Maximum Transmission Unit...

CVE-2026-76154: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

PT-2026-94551

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access occurs in the Squashfs filesystem when a negative block offset is read from the disk, such as the offset into a decompressed fragment block. This issue is trigger...

CVE-2026-61594

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...

EUVD-2026-42951

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip...

CVE-2026-61594

djust is a Phoenix LiveView-style reactive server-side rendering library for Django with Rust-powered performance. Prior to version 1.0.7 , its live WebSocket transport authorized view mounts via check_view_auth rather than Django's View.dispatch() chain. This caused standard Django authorization...

CVE-2026-61594 djust has an authorization bypass on the WebSocket/SSE mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...

CVE-2026-61594 djust has an authorization bypass on the WebSocket/SSE mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...

GHSA-XHHM-F6HP-2QWJ djust has an authorization bypass on the WebSocket/SSE mount path

Impact The live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — a...

djust has an authorization bypass on the WebSocket/SSE mount path

Impact The live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — a...

CVE-2026-92780

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-76448

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76426

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL...

CVE-2026-76425

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...

CVE-2026-76413

A vulnerability in Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An...