CVE-2026-90454 Missing authorization in Malcolm

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90450 Incorrect Authorization in Malcolm

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90449 Missing Authentication for Critical Function in Malcolm

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

CVE-2026-90448 Missing Authorization in Malcolm

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifie...

CVE-2026-54258

ZoneMinder , a free open-source closed-circuit television (CCTV) application, is affected by an authorization bypass in direct event media endpoints. In versions prior to 1.36.39 , 1.38.4 , and 1.39.11 , an authenticated low-privileged user holding only coarse Events=View and/or Snapshots=View pe...

EUVD-2026-76752

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

CVE-2026-54258

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

GHSA-99H5-JHH7-V3R3 Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

CVE-2026-44715 OpenMRS has Broken Access Control in HL7 Configuration

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

CVE-2026-44715

OpenMRS , an open-source electronic medical record platform, is affected by a Broken Access Control vulnerability in its HL7 configuration. Prior to versions 1.23.0 and 2.10.0 , the administrative DWR method startHl7ArchiveMigration, which should be restricted to admin-level accounts, is accessib...

CVE-2026-44715 OpenMRS has Broken Access Control in HL7 Configuration

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

CVE-2026-89693

A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. This vulnerability arises from improper error handling within the nfsd4create function, which is responsible for creating files and directories. When Access Control Lists ACLs are translated, any errors are silently...

CVE-2026-49439 OpenRemote read-only asset users can write predicted datapoints

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue...

CVE-2026-49439 OpenRemote read-only asset users can write predicted datapoints

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue...

EUVD-2026-76694

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue...

CVE-2026-49439

OpenRemote (open-source IoT platform) has a missing authorization flaw in its predicted datapoint write endpoint (PUT /api/{realm}/asset/predicted/{assetId}/{attributeName}). The implementation checks READ_ASSETS instead of requiring write:assets before calling assetPredictedDatapointService.upda...

CVE-2026-49439 OpenRemote read-only asset users can write predicted datapoints

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue...

EUVD-2026-76692

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

DEBIAN-CVE-2026-89560

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

CVE-2026-81915

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...