PT-2026-91101

The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites...

CVE-2026-84574: Improper Access Control

A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Privacy preferences...

PT-2026-91160

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboo...

PT-2026-91267

Name of the Vulnerable Software and Affected Versions Cisco Secure Email Gateway versions 15.5 and earlier Cisco Secure Email and Web Manager versions 15.5 and earlier Description Multiple issues related to improper access control were identified during an internal security review. These issues...

PT-2026-91228

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

PT-2026-91738

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.15.3 ZITADEL versions 3.0.0 through 3.4.12 Description A bug exists in how the platform updates permissions when multiple project roles are deleted simultaneously. This issue specifically affects User Grants on...

Ivanti Endpoint Manager Mobile Privilege Escalation

The vulnerability of the Ivanti Endpoint Manager Mobile EPMM application for managing the lifecycle of mobile devices and mobile applications formerly known as MobileIron Core is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to elevate their...

Internal Operations Component Full Control

The vulnerability of the Internal Operations component of the Oracle Spares Management software lies in the lack of access control mechanisms. Exploiting this vulnerability allows a malicious actor to gain full control over the system through HTTP requests...

Oracle In-Memory Cost Management Internal Operations Unauthorized Access

The vulnerability of the Internal Operations component of the Oracle In-Memory Cost Management for Discrete Industries software solution is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to create, delete, or modify...

Siebel Cloud Manager Data Compromise

The vulnerability of the Siebel Cloud Manager cloud version of the Siebel CRM Cloud Applications system’s customer relationship management system is related to lack of access control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and...

Enterprise Infrastructure Security Unauthorized Access

The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to read, create, modify, and dele...

Cisco IOS XR Data Compromise

The vulnerability of Cisco IOS XR operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

Fortinet FortiSandbox Unauthorized Access

The vulnerability of the graphical user interface of Fortinet’s FortiSandbox and FortiSandbox Cloud systems relates to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through specially...

Oracle BI Publisher Security Full Control

The vulnerability of the BI Platform Security component of the Oracle BI Publisher software for creating reports is related to access control errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP protocol...

Git repository managers API Privilege Escalation

The vulnerability in the API for handling email addresses of Git repositories managed by Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

Gitea Migration SSRF

The vulnerability of the migration and mirroring mechanism of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

Siebel CRM Database Upgrade Data Compromise

The vulnerability of the Database Upgrade component in the Siebel CRM deployment tools for deploying, configuring, and updating server infrastructure relates to deficiencies in access control. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and...

CVE-2026-84573: Improper Access Control

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

CVE-2026-84585: Improper Access Control

A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access local network devices without user consent...

CVE-2026-90565

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...