CVE-2026-12258

CVE-2026-12258 is an information disclosure vulnerability in Hiperdino's REST v1.0 API . The public endpoint customer/check requires only a static bearer token for authentication, with no per-user credentials, rate limiting, or generic error handling. An attacker holding this token can submit tel...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control through a crafted command. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: nfs: fixed the acl memory leak in posixaclcreate When reviewing another nfs xfstests report, I found that errors related to acl and defaultACL in nfs3proccreate and nfs3procmknod might be exposed. These issues need to be...

Astra Linux – Vulnerability in libde265

A issue has been found in libde265 v1.0.8 due to incorrect access control. A segmentation fault has occurred as a result of a READ memory access in the deriveboundaryStrength function of deblock.cc. This vulnerability causes a segmentation fault and results in the crash of the application, leadin...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address did not prohibit leading zero characters in octal literals. This may allow bypassing access control based on IP addresses. validateipv4address and validateipv46address...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A user with sufficient privileges can create a malformed ACL selector, which, when accessed, triggers a server panic and subsequent denial of service. This issue has been fixed in Redis 7.2.7 and 7.4.2...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in the 389-DS-base

A access control bypass vulnerability was discovered in version 389-ds-base. This issue arises from improper handling of filters, which can lead to incorrect results. However, further analysis revealed that it actually constitutes an access control bypass. This vulnerability could allow any remot...

Astra Linux – Vulnerability in Tomcat9

Improper access control and incorrect authorization vulnerabilities in Apache Tomcat can lead to bypassing security constraints. This occurs when a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat versions as...

Astra Linux – Vulnerability in Samba

A vulnerability was discovered in Samba. A delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object’s creation. This issue arises because the administrator...

Astra Linux – Vulnerability in LibreOffice

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to create documents that would load external links without any prompts. In affected versions of LibreOffice documents that used “floating frames” linked to external files, the contents of those...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of the Extensions API in Google Chrome prior to version 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control through a crafted HTML page...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. A vulnerability exists starting from version 2.2, and is related to out-of-bounds reads and integer overflow leading to buffer overflow. This vulnerability is present in versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, the Redis BIT...

Astra Linux – Vulnerability in Linux, BlueZ

Improper access control in BlueZ may allow a authenticated user to potentially enable information disclosure through adjacent access...

CVE-2026-90891

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboo...

CVE-2026-8821

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...

CVE-2026-81566

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-20773

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...