CVE-2026-12215: Unrestricted Upload of File with Dangerous Type

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

CVE-2026-88260: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM Build 109...

CVE-2026-78135: Improper Enforcement of Behavioral Workflow

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATECHILDSA requests are mishandled, there can be an authentication bypass...

CVE-2026-86782: Authorization Bypass Through User-Controlled Key

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-82305: Authorization Bypass Through User-Controlled Key

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

CVE-2026-62134: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...

CVE-2026-62113: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

CVE-2026-86793: Improper Control of Generation of Code

SGLang allows unauthenticated pickle deserialization through /updateweightsfromtensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE...

CVE-2026-89252: Authorization Bypass Through User-Controlled Key

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...

CVE-2026-89012: Improper Handling of Case Sensitivity

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-79395

The Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier) is vulnerable to an improper authentication flaw in the Sofia IPC daemon . The vulnerability exists within the WS-Security (wsse:UsernameToken) verification routine, allowing remote attackers to bypass authentication by s...

PT-2026-90046

An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...

PT-2026-90494

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as hero image and gallery, is where the referenced file is authorized against the user's file-manager...

PT-2026-89898

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

PT-2026-90502

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

PT-2026-89885

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

PT-2026-90518

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

ROS-20260911-73-0202

The vulnerability of the Link Preview function in browsers such as Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...

PT-2026-90523

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

PT-2026-89904

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a catego...