CVE-2026-77133

CVE-2026-77133 is a broken access control vulnerability in the TYPO3 extension femanager . When the profile edit plugin uses its default field configuration, it fails to restrict which frontend usergroups a logged-in user may assign to their own account, enabling self-service privilege escalation...

CVE-2026-77133 Broken Access Control in extension "femanager" (femanager)

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

PT-2026-81905

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions prior to 1.4.8 @better-auth/sso versions prior to 1.6.27 @better-auth/sso versions prior to 1.7.0-rc.5 Description Two domain-ownership flaws exist when the SSO plugin is active. If domain verification is disabled,...

PT-2026-81233

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

Intel Ethernet Network Adapter Driver Heap Buffer Overflow DoS

The vulnerability of the icedevlinkreinitdown function in the drivers/net/ethernet/intel/ice/devlink/devlink.c file of the Intel Ethernet network adapter driver for the Linux operating system is related to the assignment of the pointer L. Exploiting this vulnerability could allow an attacker to...

Intel Data Accelerator Driver Buffer Overflow

The vulnerability of the idxdresetdone function in the drivers/dma/idxd/init.c module of the Intel Data Accelerator driver for the Linux operating system is related to the assignment of a pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validates NIX’s maximum number of LFs correctly. NIX’s maximum number of LFs can be set using the devlink command. However, this can be done before assigning any LFs to a PF/VF. The condition used to check whether a...

ROS-20260824-73-0014

The vulnerability in gobgp is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges...

Linux SPIWPCMFIU Component DoS

The vulnerability of the drivers/spi/spi-wpcm-fiu.c component in the Linux operating system is related to pointer assignment errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

ImageMagick Pointer Assignment DoS

The vulnerability of the console-based graphic editor ImageMagick is related to pointer assignment errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

laravel-access-control-lab

laravel-access-control-lab A deliberately vulnerable Larave...

CVE-2026-77710

misp-stix (the MISP STIX import library) is vulnerable to STIX2 parser confusion and mass assignment (CWE-915, CWE-807). The import logic selected between the internal MISP parser and the external STIX parser based on untrusted metadata—MISP-specific tool labels (STIX2) or document title (STIX1)—...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

ROS-20260821-73-0028

The vulnerability of the ocfs2deleteosb function in the Linux operating system is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260821-73-0013

The vulnerability of the qla24xxbuildscsitype6iocbs function in the drivers/scsi/qla2xxx/qlaiocb.c module of the Linux SCSI device driver relates to the pointer assignment. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260821-73-0040

The vulnerability of the nulltimeoutrq function in the Linux operating system’s kernel is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...