CVE-2026-77165: Improper Access Control

File owners were unable to unlock TYPETOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database...

CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

Cisco IOS XR Software Security Hardening Release: September 2026 (cisco-sa-hardening-iosxr-qg64NcM)

According to its self-reported version, Cisco IOS XR is affected by multiple vulnerabilities. - Multiple vulnerabilities in Cisco IOS XR Software due to improper resource control issues could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service conditio...

CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2 . An authenticated panel user can modify the xray configuration template via the settings interface and trigger a panel restart. This action causes the xray management gRPC service —which defaults to a loopback binding—to be regenerate...

CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

CVE-2026-91164: Improper Access Control

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

The vulnerability of the instancesPost() function in the cmd/incusd/instances_post.go file of the container management system and the Incus virtual machine manager, which allows a attacker to disclose protected information

The vulnerability of the instancesPost function in the cmd/incusd/instancespost.go file of the container management system and the Incus virtual machine manager is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

PT-2026-96210

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description The software fails to validate object ownership across multiple resource types. Authenticated users can read, modify, and delete business objects belonging to other users by submitting direct object...

Linux Distros Unpatched Vulnerability : CVE-2026-93565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming...

CVE-2026-79319

Stencil core 4.43.5 is identified as vulnerable to Incorrect Access Control . The vulnerability type is confirmed across NVD and CVE List entries, but no further technical details—such as the specific affected component, root cause, impact scope, or a patched version—are provided in the current d...

PT-2026-96119

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.2 Description The /assets/events API endpoint fails to restrict asset events to the Dags that the caller is authorized to read. Authenticated users with asset-read access can enumerate asset events for Dags...

PT-2026-96259

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts Description Management chat-record routes authorize the path application id but load records using global chat id and chat record id values without verifying if the chat belongs to the authorized application...

CVE-2026-79319: Exposure of Sensitive Information to an Unauthorized Actor

Stencil core 4.43.5 is vulnerable to Incorrect Access Control...

CVE-2026-79319

Stencil core 4.43.5 is vulnerable to Incorrect Access Control...

CVE-2026-67827

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

The vulnerability of the `storagePoolVolumesPost()` function in the `cmd/incusd/storage_volumes.go` file of the container management system and the Incus virtual machine manager, which allows a attacker to disclose protected information.

The vulnerability of the storagePoolVolumesPost function in the cmd/incusd/storagevolumes.go file of the container management system and the Incus virtual machine manager is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to disclose sensitive...

CVE-2026-79316: Improper Access Control

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4045-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4045-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...

CVE-2026-94036 D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwdset results in improper access controls. The attack must originate from...

CVE-2026-94036

D-Link DIR-X1860 and DIR-X1860Z routers (up to version 1.0.2.220120.165402) are affected by an improper access control flaw in the /ubus file of the routerd component. Manipulation of the passwd_set argument allows an attacker on the local network to bypass access controls, with no authentication...