PT-2026-52699

Name of the Vulnerable Software and Affected Versions Peplink InControl 2 versions 2 through 2.14.2 Description An access control bypass exists in certain /rest/o/orgId endpoints. This issue allows the use of a semicolon to circumvent established access-control rules. Recommendations Update Pepli...

ROS-20260626-73-0016

The vulnerability in containerd is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

PT-2026-52701

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.16593 Description Improper access control allows the unauthorized reading of private user data through the comment templates endpoint. Recommendations Update to version 2026.2.16593...

PT-2026-52734

Name of the Vulnerable Software and Affected Versions Five Star Restaurant Menu versions prior to 2.5.3 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 2.5.2...

PT-2026-53003

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description The Monitor Agent plugin in monitor agent exposes internal metrics and plugin information through a REST API. The responses from the /api/plugins.json endpoint and related endpoints unintentionally...

PT-2026-52709

Name of the Vulnerable Software and Affected Versions Forget About Shortcode Buttons versions prior to 2.1.4 Description Broken access control allows contributors to perform unauthorized actions within the software. Recommendations Update to a version newer than 2.1.3...

ROS-20260626-73-0004

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2026-52985

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21 Description An access control bypass exists in the previewFileFromExecution endpoint GET '/api/v1/tenant/executions/executionId/file/preview'. This issue allows an authenticated...

PT-2026-52710

Name of the Vulnerable Software and Affected Versions Restaurant Menu by MotoPress versions prior to 2.4.12 Description Broken access control allows users with the Subscriber role to perform unauthorized actions within the plugin. Recommendations Update Restaurant Menu by MotoPress to version...

PT-2026-52705

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.16593 Description Improper access control allows unauthorized reading of saved queries and tags. Recommendations Update to version 2026.2.16593...

PT-2026-52711

Name of the Vulnerable Software and Affected Versions Live Copy Paste for Elementor versions prior to 1.5.4 Description Broken access control allows users with the Contributor role to perform unauthorized actions. Recommendations Update Live Copy Paste for Elementor to version 1.5.4 or later...

SUSE SLES16: tomcat11 / tomcat11-admin-webapps / tomcat11-doc / etc (SUSE-SU-2026:22196-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22196-1 advisory. This update for tomcat11 fixes the following issues Update to Tomcat 11.0.22: - CVE-2026-41284: Unbounded read in WebDAV LOCK and...

GO-2026-5716 Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability call in github.com/kubewarden/kubewarden-controller

Kubewarden vulnerable to RBAC Reconnaissance via unchecked cani host capability call in github.com/kubewarden/kubewarden-controller...

GO-2026-5530 Note Mark has Broken Access Control on Asset Download in github.com/enchant97/note-mark/backend

Note Mark has Broken Access Control on Asset Download in github.com/enchant97/note-mark/backend...

GO-2026-5458 File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser

File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser...

GO-2026-5440 Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * in github.com/xyproto/algernon

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: in github.com/xyproto/algernon...

GO-2026-5417 CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns

CoreDNS' transfer stanza selection uses lexicographic compare subzone ACL bypass in github.com/coredns/coredns...

GO-2026-5438 Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor

Velociraptor vulnerability in the query plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor...

GO-2026-5428 Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug in code.vikunja.io/api

Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the improper handling of user-supplied URLs in the acmeurl parameter, lack of access control in the certificate key-fetch process, and...