CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability. Authenticated users can bypass collection-level permissions by directly accessing the client-upload route , allowing them to upload files without the required permissions and circumv...

CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-56724 Zammad: Incorrect implementation of permission checks in the knowledge base module

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

CVE-2026-85291

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::changepassword method accepts a userid from the URL and updates that account's password without an object-level authorization check. An authenticated secondary...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Java SDK ( CVE-2026-61308, CVE-2026-70907 & CVE-2026-60589)

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Java SDK. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime.

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

Security Bulletin: Multiple vulnerabilities in IBM Semeru affect IBM Sterling Connect:Direct for Microsoft Windows

Summary There are vulnerabilities in IBM Semeru Runtime version 17 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs CVE-2026-61308, CVE-2026-70907, CVE-2026-60589, CVE-2026-16440 Vulnerability Details...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-88421

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

BIT-GITLAB-2026-86341 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

BIT-NEXTCLOUD-2026-68493

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...

CVE-2026-88421: Improper Access Control

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

MetaPermit: Scalable and Auditable Access Control for AI Agents Via LLM-Inferred Meta-Attributes

The rise of autonomous AI agents equipped with tools has introduced significant security risks, ranging from unintended tool misuse to adversarial manipulation through Indirect Prompt Injection IPI attacks. In practice, deployed agent systems such as OpenAI Codex and Claude Code protect tool...

CVE-2026-79153

The Seclore FileSecure Desktop Client before version 3.25.1.0 contains an improper access control vulnerability within its kernel-mode driver component. This flaw allows an authenticated local user to achieve privilege escalation to NT AUTHORITY\SYSTEM on affected systems. No specific exploit cod...

PT-2026-98986

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

CVE-2026-88421

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

EUVD-2026-87081

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

EUVD-2026-87080

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

PT-2026-98951

Name of the Vulnerable Software and Affected Versions @payloadcms/storage-vercel-blob affected versions not specified Description Improper access control in the storage adapter allows authenticated users to bypass collection-level permissions. By directly accessing the 'client-upload' endpoint,...

PT-2026-98942

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description Broken access control in the GraphQL API allows an authenticated user to access taskbar item data belonging to another user. By crafting a request with the target user's taskbar identifier, an attacke...