PT-2026-93341

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with user or operator credentials can execute commands with root privileges on the device. This is possible through a command...

PT-2026-93659

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read and stack buffer overflow exist in the rtw get wps attr function within the rtl8723bs driver. The function processes WPS attributes from wireless management frames...

CVE-2026-92569: Server-Side Request Forgery (SSRF)

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

PT-2026-93356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A high-privileged remote attacker can execute commands with root privileges on the device via a command injection flaw. This occurs when a crafted GET request is...

CVE-2026-92750: Missing Authorization

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...

PT-2026-93440

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where preemption is not properly disabled during the execution of the bpf get stackid function. Specifically, the get perf callchain call requires...

PT-2026-94122

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description An issue exists in the per-object authorization mechanism involving the get object and has object permission functions. While authorization was enforced on WebSocket mount and event paths, it was missi...

CVE-2026-92460: Missing Authorization

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92468: Authorization Bypass Through User-Controlled Key

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/indexName and GET /agg/requestStat/indexName/routing path...

CVE-2026-92463: Missing Authorization

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-92461: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

PT-2026-93585

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the ASOC hdac hda component. The hdac hda dev probe function acquires an HDA link using snd hdac ext bus link get before registering the ASoC component. ...

PT-2026-93348

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get iodd port info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

PT-2026-93352

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

EUVD-2026-78434

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-91994 Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-91994

Semaphore UI through 2.19.12 contains a missing authorization vulnerability in the GetMustCanMiddleware component. The middleware exempts GET and HEAD requests from project resource permission checks, allowing attackers with guest or task_runner roles to read all project environments—including pl...

CVE-2026-52823

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...