CVE-2026-21133: Undefined Security Weakness

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...

PT-2026-111077

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.112.0 Description Authenticated users with a common operational role can modify records beyond their assigned permissions. This occurs due to missing validation in certain endpoints, allowing attackers to...

PT-2026-110812

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection...

PT-2026-111032

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.3 Frappe ERPNext versions prior to 16.35.0 Description Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to send requests to these endpoints to modify data th...

PT-2026-111037

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.120.0 Frappe ERPNext versions 16.x prior to 16.33.0 Description Certain endpoints fail to enforce proper permission checks, leading to a missing authorization issue. This allows authenticated users with low...

CVE-2026-109637: Missing Authorization

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records...

CVE-2026-109614: Missing Authorization

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...

PT-2026-110673

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.10.0 through 3.32.2 Description A heap buffer overflow occurs in the WinPR png write data callback when a realloc failure happens. A malicious RDP clipboard peer can trigger an out-of-bounds memcpy during PNG conversion by...

CVE-2026-109664: Missing Authorization

Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to...

CVE-2026-109247: Improper Limitation of a Pathname to a Restricted Directory

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-108802: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2026-109645: Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2026-3195)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3195 advisory. A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG Scalable Vector Graphics CSS Cascading Style Sheets data. A loca...

TencentOS Server 3: coreutils (TSSA-2026:1143)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1143 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

EulerOS 2.0 SP13 : libkcapi (EulerOS-SA-2026-4062)

According to the versions of the libkcapi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an...

CVE-2026-109656: Missing Authorization

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data...

CVE-2026-109398: Improper Handling of Highly Compressed Data (Data Amplification)

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-21127: Undefined Security Weakness

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data...

PT-2026-110904

Name of the Vulnerable Software and Affected Versions HAProxy Data Plane API versions 2.2.0 through 2.9.28 HAProxy Data Plane API versions 3.0.0 through 3.0.24 HAProxy Data Plane API versions 3.1.0 through 3.2.16 HAProxy Data Plane API versions 3.3.0 through 3.3.8 HAProxy Data Plane API versions...

PT-2026-111027

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.0 Frappe ERPNext versions 16.x prior to 16.34.0 Description Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to call these endpoints to modify data that...