CVE-2026-52776

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. This vulnerability occurs because the driver incorrectly allocates memory for a keymap, leading to an out-of-bounds memory access. A local user with access to a specially crafted input device could exploit this to read or write t...

CVE-2026-29988

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

SUSE CVE-2026-20901

Improper input validation for some IntelR XeonR processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack...

SUSE CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

Incorrect Authorization

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when a constraint for a longer path is specified before a more...

Improper Authorization

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Authorization through the Request.isUserInRole and RealmBase.hasRole role-checking paths in...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition due to a race condition in the setting of permissions for Unix domain sockets. An attacker can gain...

Insufficient Session Expiration

Overview org.apache.tomcat:tomcat-websocket is a Tomcat WebSocket JSR356 implementation. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when the associated HTTP session ends. An attacker can maintain access...

Insufficient Session Expiration

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when the associated HTTP session ends. An...

EUVD-2026-66118

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation...

GHSA-GCX9-497G-6CP6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

PT-2026-82100

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An improper authorization check allows an authenticated user with reporter-role permissions who authored a merge...

EUVD-2023-60608

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...

EUVD-2026-66748

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2026-26447

Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap...

CVE-2023-42179

Bird Home Automation GmbH D1101V-F 000140 is affected by an Incorrect Access Control vulnerability stemming from flaws in the key derivation process and the password validation process . The CVSS 3.1 base score is 9.8 (Critical) , with a network vector requiring no privileges or user interaction ...

PT-2026-82049

Name of the Vulnerable Software and Affected Versions Reviews and Rating – Google Reviews plugin for WordPress versions prior to 5.11 Description Stored Cross-Site Scripting occurs because the wp display shortcode handler allows attacker-controlled html tags values to define raw HTML tags and emb...