EUVD-2026-86476

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-100306: Client-Side Enforcement of Server-Side Security

TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links...

PT-2026-99063

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description The software fails to validate write passwords on submission endpoints, performing the check only on the front end. This allows remote unauthenticated attackers to submit form entries directl...

CVE-2026-17545: Improper Handling of Windows Device Names

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-87720

A vulnerability exists in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 due to Incorrect Authorization (CWE-863) . The flaw stems from project name normalization in ProjectUtil.stripGitSuffix and eviction logic in ProjectCacheImpl. Specificall...

CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

firefox: thunderbird: Use-after-free in the Disability Access APIs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Disability Access APIs component...

CVE-2026-57590

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before...

EUVD-2026-85825

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before...

CVE-2026-57590 Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before...

CVE-2026-57590 Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before...

CVE-2026-57590

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler (versions before 3.4.3 ). The root cause is that the affected APIs fail to verify if an authenticated user has the necessary permissions to access the project associated with the target Task Group. This...

firefox: thunderbird: Use-after-free in the Disability Access APIs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Disability Access APIs component...

CVE-2026-87720: Incorrect Authorization

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

PT-2026-98310

Name of the Vulnerable Software and Affected Versions Gerrit Code Review versions 2.16.0 through 3.12.9 Gerrit Code Review versions 3.13.0 through 3.13.8 Gerrit Code Review versions 3.14.0 through 3.14.2 Description Incorrect authorization occurs during project name normalization in...

PT-2026-97777

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3 Description A missing authorization issue exists in the Task Group APIs. The affected APIs fail to properly verify if an authenticated user possesses the necessary permissions to access the proje...

CVE-2026-57590: Incorrect Authorization

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before...

NPM: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

NPM: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse vulnerability discovered by ? in WordPress Npm 9router versions = 0.4.80...

Linux Distros Unpatched Vulnerability : CVE-2026-92016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...