Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE

Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only "under specific conditions" that it has not described. One flaw affects Check...

Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

SummaryAn authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.When the tool is invoked, the runner imports and...

senaite.core Vulnerable to Eval Injection and Missing Authorization

SummaryAn unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-15823

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

EUVD-2026-75236

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-19583

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

EUVD-2026-75208

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

PT-2026-89464

Dell ThinOS 10, versions prior to 2605 10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

PT-2026-89417

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

Security update for libzypp, zypper (critical)

openSUSE security update: security update for libzypp, zypper ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21808-1 Rating: critical References: bsc1257249 bsc1271730 bsc1272534 bsc1273242 bsc1274091 bsc1274625 bsc1277790 Affected Products: openSU...

CVE-2026-81052: Download of Code Without Integrity Check

Dell ThinOS 10, versions prior to 260510.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution...

PT-2026-89582

Name of the Vulnerable Software and Affected Versions jose versions prior to 0.11.0 Description The jose package for OCaml fails to properly validate RSA signatures. The library only confirms that PKCS 1 decoding succeeds but does not perform the necessary verification steps using the public key,...

PT-2026-89540

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

PT-2026-89466

Dell ThinOS 10, versions prior to 2605 10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-81049: Missing Support for Integrity Check

Dell ThinOS 10, versions prior to 260510.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-15460

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-87997

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-87997 Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...