CVE-2026-12613: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue...

PT-2026-111027

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.0 Frappe ERPNext versions 16.x prior to 16.34.0 Description Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to call these endpoints to modify data that...

CVE-2026-109650: Missing Authorization

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned rol...

CVE-2026-109648: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

CVE-2026-109644: Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what the...

CVE-2026-109625: Missing Authorization

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

CVE-2026-109624: Missing Authorization

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits...

CVE-2026-109611: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits...

CVE-2026-85969: Out-of-bounds Write

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of...

CVE-2026-92681: Missing Authentication for Critical Function

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-109188: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...

CVE-2026-109661: Missing Authorization

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial da...

PT-2026-111122

Name of the Vulnerable Software and Affected Versions IBM i version 7.3 IBM i version 7.4 IBM i version 7.5 IBM i version 7.6 Description Improper data sanitization within the HTTP Server Administration web application allows a remote authenticated attacker to execute arbitrary code or obtain...

CVE-2026-106605: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price...

PT-2026-111100

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

ROS-20261012-73-0234

The vulnerability of the mctp-i2c.c component in the Linux operating system’s kernel is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to access confidential data...

PT-2026-110652

Name of the Vulnerable Software and Affected Versions hexpm hex versions 0.11.2 through 2.5.1 Description An improper handling of highly compressed data, known as data amplification, allows an untrusted package mirror to exhaust the memory or disk space of a machine running mix deps.get, mix...

PT-2026-110649

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.x Description Improper privilege management allows a remote authenticated attacker with delegated database-administrator privileges to perform backup...

PT-2026-110808

🚨 CVE-2026-85971 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and...

PT-2026-111102

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can obtain sensitive information due to an exposure of sensitive data to an unauthorized actor. Recommendations At the moment, there is no...