CVE-2026-66384

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

EUVD-2026-57255

A low-privileged authenticated user may access restricted support information under specific conditions...

CVE-2026-68758

Technical details about CVE-2026-68758 are not publicly available in the provided documents; no affected products, versions, root cause, or remediation are specified. Monitor for updates.

EUVD-2026-57248

An authenticated user may view private Puppet module metadata without repository read access...

EUVD-2026-57244

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...

CVE-2026-66380

CVE-2026-66380 describes a access control bypass where an authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. The public metrics indicate CVSS 3.1 base score 4.3 (Medium), with attack vector NETWORK and privileges required LOW,...

CVE-2026-73374 Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-14859

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-12976

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

GitLab 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-16494)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify proje...

PT-2026-71119

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

PT-2026-71300

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 IBM Verify Identity Access Container versions 11.0 through 11.0.3 IBM Security Verify Access Container versions 10.0 through...

PT-2026-71169

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands...

PT-2026-71104

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...

PT-2026-71088

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS POLICY PLUGIN URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs existing object tag incorrectly for PreparedIamMode::Opa, causing maybe merg...

PT-2026-71082

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the render tag badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the...