Ubiquiti UniFi OS Server < 5.1.37 Multiple Vulnerabilities

The version of Ubiquiti UniFi OS Server installed on the remote host is prior to 5.1.37. It is, therefore, affected by multiple vulnerabilities: - A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability fou...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21801-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21801-1 advisory. - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates bsc1258543....

openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21809-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21809-1 advisory. Update to version 3.21.1: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST...

PT-2026-89775

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

PT-2026-90509

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-49464: Authorization Bypass Through User-Controlled Key

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

CVE-2026-90447: Authentication Bypass by Spoofing

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-54248: Improper Verification of Cryptographic Signature

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-12215: Unrestricted Upload of File with Dangerous Type

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

CVE-2026-88260: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM Build 109...

CVE-2026-78135: Improper Enforcement of Behavioral Workflow

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATECHILDSA requests are mishandled, there can be an authentication bypass...

CVE-2026-86782: Authorization Bypass Through User-Controlled Key

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-82305: Authorization Bypass Through User-Controlled Key

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

CVE-2026-62134: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...

CVE-2026-62113: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

CVE-2026-86793: Improper Control of Generation of Code

SGLang allows unauthenticated pickle deserialization through /updateweightsfromtensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE...

CVE-2026-89252: Authorization Bypass Through User-Controlled Key

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...

CVE-2026-89012: Improper Handling of Case Sensitivity

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-79395

The Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier) is vulnerable to an improper authentication flaw in the Sofia IPC daemon . The vulnerability exists within the WS-Security (wsse:UsernameToken) verification routine, allowing remote attackers to bypass authentication by s...

PT-2026-90046

An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...