EUVD-2026-84151

Stencil core 4.43.5 is vulnerable to Incorrect Access Control...

CVE-2026-79319: Exposure of Sensitive Information to an Unauthorized Actor

Stencil core 4.43.5 is vulnerable to Incorrect Access Control...

EUVD-2026-84205

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

Linux Distros Unpatched Vulnerability : CVE-2026-93565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming...

SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4045-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4045-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...

PT-2026-96119

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.2 Description The /assets/events API endpoint fails to restrict asset events to the Dags that the caller is authorized to read. Authenticated users with asset-read access can enumerate asset events for Dags...

CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2 . An authenticated panel user can modify the xray configuration template via the settings interface and trigger a panel restart. This action causes the xray management gRPC service —which defaults to a loopback binding—to be regenerate...

CVE-2026-91164: Improper Access Control

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

PT-2026-96161

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.2 Description Tinyauth performs case-sensitive comparisons of forwarded hostnames, whereas reverse proxies typically route equivalent hostnames case-insensitively. This discrepancy allows an authenticated user wi...

container management system storagePoolVolumesPost disclosure

The vulnerability of the storagePoolVolumesPost function in the cmd/incusd/storagevolumes.go file of the container management system and the Incus virtual machine manager is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to disclose sensitive...

container management system instancesPost disclosure

The vulnerability of the instancesPost function in the cmd/incusd/instancespost.go file of the container management system and the Incus virtual machine manager is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Cisco IOS XR Software Security Hardening Release: September 2026 (cisco-sa-hardening-iosxr-qg64NcM)

According to its self-reported version, Cisco IOS XR is affected by multiple vulnerabilities. - Multiple vulnerabilities in Cisco IOS XR Software due to improper resource control issues could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service conditio...

PT-2026-96210

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description The software fails to validate object ownership across multiple resource types. Authenticated users can read, modify, and delete business objects belonging to other users by submitting direct object...

PT-2026-96243

Name of the Vulnerable Software and Affected Versions Stencil core version 4.43.5 Description Incorrect Access Control allows unauthorized users to access restricted resources or perform actions they are not permitted to execute. Recommendations At the moment, there is no information about a newe...

PT-2026-96259

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts Description Management chat-record routes authorize the path application id but load records using global chat id and chat record id values without verifying if the chat belongs to the authorized application...

PT-2026-96260

Name of the Vulnerable Software and Affected Versions x-ui version 0.3.2 Description An improper access control issue allows any authenticated panel user to modify the xray configuration template via the settings interface. By triggering a panel restart, the xray management gRPC service Google...

CVE-2026-94036 D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwdset results in improper access controls. The attack must originate from...

CVE-2026-94036 D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwdset results in improper access controls. The attack must originate from...

CVE-2026-94036

D-Link DIR-X1860 and DIR-X1860Z routers (up to version 1.0.2.220120.165402) are affected by an improper access control flaw in the /ubus file of the routerd component. Manipulation of the passwd_set argument allows an attacker on the local network to bypass access controls, with no authentication...

CVE-2026-87840

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...