CVE-2026-92461: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

PT-2026-93994

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to perform a SQL injection attack. This occurs due to insufficient validation of...

PT-2026-93818

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.25 Description A cross-site request forgery issue exists in the User Management component. A remote attacker can manipulate the UserController::del and UserController::mod functions within the...

PT-2026-93707

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description An authorization failure exists in the 'GET /admin-api/system/user/page' endpoint because the @PreAuthorize annotation is commented out. This allows authenticated back-office users who lack the...

PT-2026-93339

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An unauthenticated remote attacker can exploit an authentication bypass in the account log function to gain administrative access, regardless of whether accounts...

PT-2026-94097

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 and earlier Description The CloneSite plugin contains a stored OS command injection flaw. The issue occurs in plugin/CloneSite/cloneClient.json.php where a stored SSH password is inserted into a command string using str...

PT-2026-93706

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization checks in the CrmFlowController deleteFlowStep function allow any authenticated back-office user to delete arbitrary approval workflow steps. This can be achieved by...

CVE-2026-86462: Insufficient Session Expiration

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2026-92603: Authorization Bypass Through User-Controlled Key

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message r...

PT-2026-93826

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update category.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit...

PT-2026-93702

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description A missing authorization issue exists in the onSale handler of the StoreProductController. This allows authenticated back-office users to modify the sale status of products without proper permission...

CVE-2026-90005: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: samples/damon/wsse: handle damonstart failure Patch series "samples/damon: handle damonstart,stop failures". All DAMON sample modules are not correctly handling failures from damonstart. Among those, mtier also has an additional...

CVE-2026-27546: Authentication Bypass Using an Alternate Path or Channel

An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...

PT-2026-93333

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...

CVE-2026-76705

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-76689

A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafted configuration data. Successful...

CVE-2026-76677

A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system compromise...

Exploit for Improper Authentication in Jfrog Artifactory

CVE‑2026‑82329 – JFrog Artifactory Auth B...

EUVD-2026-79215

A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafted configuration data. Successful...

CVE-2026-76684 Authentication Bypass Vulnerabilities in HPE Networking EdgeConnect SD-WAN Orchestrator API

Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading ...