PT-2026-70315

Name of the Vulnerable Software and Affected Versions IntelR XeonR processors affected versions not specified Description Improper access control in the firmware for the Alias Checking Trusted Module may allow an escalation of privilege. An adversary with access to startup code and System...

PT-2026-70145

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.3.2 Description Broken access control allows unauthenticated remote attackers to read all form submissions, including personally identifiable information, through the admin form-submission viewer. This occurs because the view...

PT-2026-70130

Name of the Vulnerable Software and Affected Versions Peppermint Lab Peppermint versions through commit ba6e217 Description Broken access control occurs because the Config.roles active flag defaults to false, which causes permission checks on ticket, client, and user handlers to behave as no-ops...

PT-2026-70138

Name of the Vulnerable Software and Affected Versions BadChoice Handesk versions prior to 2026-07-10 Description Broken access control allows authenticated agents to overwrite lead records belonging to other teams. This occurs because the 'LeadsController@update' endpoint lacks authorization chec...

PT-2026-70136

Name of the Vulnerable Software and Affected Versions Peppermint Lab Peppermint versions prior to commit ba6e217 Description Broken access control allows authenticated non-administrative users to reconfigure global OIDC/SSO settings. This occurs because a configuration endpoint fails to perform...

PT-2026-70796

Name of the Vulnerable Software and Affected Versions ishankportfolio versions prior to 1.0.1 Description Contact form submissions may be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database...

PT-2026-70273

Name of the Vulnerable Software and Affected Versions IntelR XeonR 6 Scalable processors with IntelR TDX affected versions not specified Description Insufficient granularity of access control in a subsystem may allow an information disclosure. An authorized adversary with an authenticated user ca...

Intel® Xeon® processor with Alias Checking Trusted Module Advisory

Summary: A potential security vulnerability in the Alias Checking Trusted Module for some Intel® Xeon® processor may allow escalation of privilege. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2026-20898 Description: Improper acce...

Intel® Processor Firmware  Advisory - 01435

Summary: A potential security vulnerability in some Intel® Processors may allow escalation of privilege. Intel is releasing microcode updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2026-20716 Description: Improper access control for some Intel® Processors with...

PT-2026-70940

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/library id/book id/fmt in src/calibre/srv/books.py omits needs db write=True, causing Router.dispatch to skip ctx.check for write access before update annotations passes...

PT-2026-70144

Name of the Vulnerable Software and Affected Versions Idurar IDURAR ERP CRM version 4.1.0 Description A broken access control issue allows unauthenticated remote attackers to download invoice PDF files containing customer personally identifiable information PII. This occurs because the '/download...

PT-2026-70129

Name of the Vulnerable Software and Affected Versions Ladybird Web Solution Faveo Helpdesk version 2.0.3 Description A broken access control issue exists in the v1 REST API. The API verifies if a requested ticket exists but fails to verify if the authenticated user owns that ticket. This allows a...

PT-2026-70265

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

PT-2026-70484

Name of the Vulnerable Software and Affected Versions User-Mode Power Service UMPS affected versions not specified Description Insufficient granularity of access control in the User-Mode Power Service UMPS allows an authorized attacker to elevate privileges locally. Recommendations At the moment,...

PT-2026-70139

Name of the Vulnerable Software and Affected Versions BadChoice Handesk versions prior to 2026-07-10 Description Broken access control allows any authenticated agent to update ticket records belonging to other teams. This occurs because the 'TicketsController@update' endpoint does not call an...

PT-2026-70307

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software for Windows affected versions not specified Description Improper access control within Ring 2: Device Drivers allows an unprivileged, unauthenticated local adversary to escalate privileges and execute local...

PT-2026-70079

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software fails to apply comment-level access-control rules during the generation of evaluation report exports. While standard comment retrieval correctly filters based on conversion...

PT-2026-70828

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.16.0 Description The addr less eq function in src/client/ns turn ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals within ioa addr in range. This allows an authenticated TURN client to relay...

PT-2026-70238

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

PT-2026-70289

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software affected versions not specified Description Improper access control within Ring 2: Device Drivers allows an unprivileged, unauthenticated local adversary to trigger a denial of service. This low-complexity...