CVE-2026-110454

The UniFi Protect AI Key is affected by an Improper Access Control vulnerability (CWE-284). A malicious actor with network access could exploit this flaw to gain access to internal resources through the device. No specific details regarding the root cause, affected versions, or remediation steps ...

EUVD-2026-100815

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

CVE-2026-110454

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

PT-2026-113641

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

PT-2026-113644

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient checking of the status of shared resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130129)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130129 advisory. Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1...

Linux Distros Unpatched Vulnerability : CVE-2026-98429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/efa: Keep EQ resources alive while IRQ is registered The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that...

CVE-2026-75748

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scop...

CVE-2026-76001

Adobe ColdFusion is impacted by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). A low-privileged attacker could exploit this flaw to achieve privilege escalation by gaining unauthorized access to internal resources. The exploit is network-based, requires no user interaction, and dep...

CVE-2026-76001 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation...

CVE-2026-74032

Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resources, which omit the caller's RBAC...

Security Bulletin: Spring Expression Language (SpEL) in IBM Sterling Control Center makes it vulnerable to Improper Control of Dynamically-Managed Code Resources (CVE-2026-59283)

Summary A Critical vulnerability in Spring Framework that allows a safety guard bypass when evaluating Spring Expression Language SpEL expressions using SimpleEvaluationContext with the expression compiler enabled, potentially leading to unauthorized actions or remote code execution; affected...

CVE-2026-74032

Wazuh versions 4.0.0 through 4.14.7 are vulnerable to an authorization bypass (CWE-863) that allows low-privileged authenticated users to access the RBAC catalog. By querying unprotected endpoints such as GET /security/actions and GET /security/resources , which fail to apply the caller's RBAC po...

CVE-2026-74032 Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions

Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resources, which omit the caller's RBAC...

CVE-2026-100104

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-89118

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application...

CVE-2026-100104

GitLab CE/EE versions 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw is caused by a time-of-check to time-of-use race condition during URL validation while performing repository import operations . This could allow ...

CVE-2026-100104 Server-Side Request Forgery (SSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

EUVD-2026-98198

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application...