EUVD-2026-101975

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

CVE-2026-16438 An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi...

PT-2026-114845

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi...

CVE-2026-87093

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-110630

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete...

EUVD-2026-101144

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-87093 MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-110630

The VentureDrake Laravel CRM (versions before 2.4.0 ) is vulnerable to a privilege escalation flaw due to an incorrect authorization vulnerability in user management. Authenticated administrators can use Role::find to assign unrestricted roles, such as the Owner role or roles belonging to other t...

CVE-2026-110630 VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete...

CVE-2026-107424

Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7...

EUVD-2026-101013

Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7...

WordPress SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment vulnerability

Unauthenticated Privilege Escalation to wpcapabilities Mass Assignment vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin FormFlow versions = 3.10.0...

CVE-2026-104748

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to and including 3.10.0 . The flaw stems from the wp_ajax_nopriv_simpleform_wp_register AJAX action failing to perfor...

CVE-2026-104748 SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the wpajaxnoprivsimpleformwpregister AJAX action lacking any capability check for role...

PT-2026-114312

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An issue exists involving incorrect permission assignment for critical resources. Recommendations Update to version 2025.1.6 or later...

ROS-20261014-73-0084

The vulnerability of the function batadvblapurgeclaims in the net/batman-adv/bridgeloopavoidance.c module, which is part of the network functions of the Linux operating system’s kernel, relates to the assignment of pointers. Exploiting this vulnerability could allow a malicious actor to cause...

CVE-2026-102851

Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally...

EUVD-2026-100323

Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally...

CVE-2026-102851

Visual Studio Code is affected by an incorrect privilege assignment vulnerability. This flaw allows an authorized attacker to bypass a security feature locally. The vulnerability has a Medium base severity (6.1) and requires local access and user interaction to exploit. Specific technical details...

CVE-2026-105445

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token PAT they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then...