CVE-2026-90953

The Image Optimizer WordPress plugin by Elementor (versions before 1.7.7 ) contains a vulnerability where it fails to enforce intended capability checks on several read REST routes . This flaw allows any authenticated user to access attachment metadata and site-wide statistics that are normally r...

EUVD-2026-89614

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

Joomla! Webservice - Password Disclosure

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. id: CVE-2023-23752 info: name: Joomla! Webservice - Password Disclosure author: badboycxcc,Sascha Brendel severity: medium description: | An issue was discovered in...

PT-2026-105515

Summary PyJWT.decode/decode complete mutates a caller-supplied options dict in place whenever verify signature is falsy, adding verify exp/verify nbf/verify iat/verify aud/verify iss/verify sub/verify jti keys directly onto that object. If application code reuses the same options dict across call...

PT-2026-103572

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An authorization check in the large file exchange feature does not correctly verify if the requesting user is a party to the requested package. This allows an...

PT-2026-103035

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

CVE-2026-102106: Improper Authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-102104: Server-Side Request Forgery (SSRF)

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-102583: Direct Request

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI...

CVE-2026-102579: Exposure of Private Personal Information to an Unauthorized Actor

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure...

PT-2026-103596

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An administrative service in Kiteworks Email Protection Gateway fails to consistently enforce administrator authentication, allowing the password check to be...

PT-2026-103087

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course without proper permission,...

PT-2026-103542

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

PT-2026-103092

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A missing capability check allows a low-privileged authenticated user to trigger the recalculation of grade penalties without the necessary permissions. This flaw enables unauthorized users to...

PT-2026-103091

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An incorrect capability check in the artificial intelligence AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required...

CVE-2026-95616: Integer Overflow or Wraparound

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

PT-2026-103275

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

PT-2026-103073

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An Editor can set file-provisioning metadata when creating a dashboard through the dashboard API because certain fields are stored without an authorization check. This allows the creation of...

PT-2026-103109

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 1.0.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 Description Server-side memory exhaustion occurs in the sshd-sftp component within the SFTP v6 check-file-name/check-file-handle extension. When...

Linux Distros Unpatched Vulnerability : CVE-2026-13720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard...