AZL-104895 CVE-2026-91768 affecting package php 8.3.33-1

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

CVE-2026-37070

CVE-2026-37070 Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37073

CVE-2026-37073 Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2026-84464

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

[SECURITY] [DSA 6514-1] php8.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6514-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 25, 2026 https://www.debian.org/security/faq -...

CVE-2026-56728

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. T...

CVE-2026-63205

In Zammad versions prior to 7.1.2 , a vulnerability exists where users with specific channel admin permissions can access unauthorized attachments. When creating or updating an email signature, the system processes inline images; if an HTML img tag points to an existing attachment, Zammad copies ...

CVE-batdappboomx

ID de CVE CVE-2022-27134 PRODUCTO batdappboomx es un contrato inteligente público que se ejecuta en la cadena de bloques EOSIO. Este contrato inteligente recompensa a sus participantes con criptomonedas si pagan alguna criptomoneda antes. Versión La última versión de este contrato inteligente. El...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-67241

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...

EUVD-2026-87221

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. T...

CVE-2026-56728

The open source helpdesk system Zammad contains a broken access control vulnerability in its GraphQL API prior to version 7.0.2 . An authenticated user can exploit this by crafting a request with a target user's taskbar identifier to read their taskbar item data . This data includes transient ses...

CVE-2026-56728 Zammad: Cross-User Taskbar Item Access Control Vulnerability

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. T...

VertXploit

VertXploit Explotación de los sistemas de control de acceso HID VertX y EDGE Resumen VertXploit es una herramienta que se puede utilizar para explotar los sistemas de control de acceso HID VertX y EDGE. Existe una vulnerabilidad en el servicio discoveryd, que no sanea los datos del usuario antes ...

CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability. Authenticated users can bypass collection-level permissions by directly accessing the client-upload route , allowing them to upload files without the required permissions and circumv...

CVE-2026-56724 Zammad: Incorrect implementation of permission checks in the knowledge base module

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

CVE-2026-85291

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::changepassword method accepts a userid from the URL and updates that account's password without an object-level authorization check. An authenticated secondary...

CVE-2026-88421

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...