CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

kernel: selinux: check connect-related permissions on TCP Fast Open

A flaw was found in the Linux kernel's Security-Enhanced Linux SELinux module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network...

PRTG Network Monitor - Local File Inclusion

PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges including administrator. A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local...

CVE-2026-96763 kvcache-ai mooncake MountSegment Request Processing segment.cpp access control

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

CVE-2026-96763 kvcache-ai mooncake MountSegment Request Processing segment.cpp access control

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

CVE-2026-96763: Improper Access Control

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

PT-2026-97736

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description Improper Access Control allows unauthorized access or modification of resources within the system. Recommendations Update to version 1.11.00.022 or later...

PT-2026-98248

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description An improper access control issue exists within the ServiceNow AI Platform. This flaw could allow an unauthenticated user to create, modify, or delete instance data beyond...

PT-2026-97918

Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. The POST '/credentials/:id/deploy-to-host' endpoint fails to verify if the records associated...

Linux Distros Unpatched Vulnerability : CVE-2026-93786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutat...

Security update for distribution (important)

openSUSE security update: security update for distribution ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21898-1 Rating: important References: bsc1268884 bsc1276677 bsc1277966 bsc1278997 bsc1279219 bsc1279316 Cross-References: CVE-2026-37236...

CVE-2026-78313: Improper Access Control

Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-85057: Improper Access Control

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...

CVE-2026-79758: Improper Access Control

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...

PT-2026-97641

Name of the Vulnerable Software and Affected Versions kvcache-ai mooncake versions 0.3.12 through 0.3.14-rc1 Description Improper access controls exist within the MountSegment Request Processing component, specifically affecting the ScopedSegmentAccess::MountSegment function in the segment.cpp...

PT-2026-98238

Name of the Vulnerable Software and Affected Versions Docmost versions 0.70.0 through 0.80.0 Description An authenticated user with low privileges who can edit an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the page is exported using...

CVE-2026-75907: Improper Authentication

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

CVE-2026-74991: Improper Access Control

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other...

CVE-2026-86858: Improper Access Control

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNo...

PT-2026-98287

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The FastCGI client access check for IPv6 addresses incorrectly compares only the first 12 bytes of a 16-byte address. This causes the listen.allowed clients chec...