CVE-2026-96740: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-101004: Missing Authentication for Critical Function

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-82379: Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...

CVE-2026-89300: Missing Authorization

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...

CVE-2026-101006: Incorrect Authorization

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function getexpenseclaims/getshiftrequests/getattendancerequests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote...

CVE-2026-82930: Missing Authentication for Critical Function

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-12342: Improper Input Validation

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

PT-2026-99771

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.15.0 Description An incorrect authorization issue exists within the Permission Validation component. The flaw allows remote exploitation by manipulating the employee argument in the get expense claims, get shift...

PT-2026-99920

Name of the Vulnerable Software and Affected Versions IdentityIQ affected versions not specified Description An unauthenticated user can achieve remote code execution on the server due to improper input validation of content submitted to web service API endpoints. Recommendations At the moment,...

PT-2026-99963

Name of the Vulnerable Software and Affected Versions StreamsHub Console for Apache Kafka affected versions not specified Description A flaw exists where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without...

PT-2026-99866

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-102334: Improper Restriction of Excessive Authentication Attempts

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

PT-2026-102398

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup wifi. Executing a manipulation of the argument login pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used...

PT-2026-102400

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description Remote command injection is possible due to improper processing of the /api/ZRQos/set online client endpoint. An attacker can exploit this by manipulating the mac argument to execute arbitrary...

PT-2026-99864

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

PT-2026-99769

Name of the Vulnerable Software and Affected Versions NotionNext versions 4.1.0 through 4.10.10 Description An issue exists in the Authentication Guard component within the cleanCache function of the pages/api/cache.js file. Remote manipulation of the token argument can lead to a complete bypass ...

PT-2026-99936

Name of the Vulnerable Software and Affected Versions WatchGuard Access Points affected versions not specified Description An improper access control issue exists within an internal API service. This allows an unauthenticated attacker with network access to the access point to obtain a valid API...

PT-2026-108341

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS. load in jwt/api jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...

CVE-2026-100903: Missing Authentication for Critical Function

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

CVE-2026-101891: Improper Access Control

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...