CVE-2026-86720: Authorization Bypass Through User-Controlled Key

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...

EUVD-2026-72396

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86441

MISP (≤2.5.45) contains inconsistent authorization checks in organisation-related dashboard widgets. Several widgets failed to honor the Security.hide_organisation_index_from_users setting, allowing authenticated users lacking the perm_sharing_group permission to enumerate organisations despite t...

CVE-2026-84256

A flaw was found in OpenVPN on Windows. An argument parsing issue allows remote authenticated users to execute arbitrary commands by providing a specially crafted certificate subject. This vulnerability could lead to a complete compromise of the affected system...

CVE-2026-82312

OpenVPN 2.0.0 through 2.6.22 and 2.7alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects...

EUVD-2026-72275

The Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

CVE-2026-84256: Improper Neutralization of Special Elements used in an OS Command

An argument parsing issue in OpenVPN 2.1rc10 through 2.6.22 and 2.7alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject...

CVE-2026-82325: Use After Free

A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages...

CVE-2026-82312: Incorrect Permission Assignment for Critical Resource

OpenVPN 2.0.0 through 2.6.22 and 2.7alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects...

CVE-2026-81830: External Control of File Name or Path

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-86255: Uncontrolled Resource Consumption

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the datesequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in its REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks . The root cause is the use of unscoped querysets , which allows any authenticated user with view permissions to access all users' private record...

CVE-2026-86122

Rowboat through version 0.9.1 is affected by a Server-Side Request Forgery (SSRF) vulnerability caused by insufficient validation of custom MCP server and webhook URLs. Authenticated users can configure these URLs to point at internal services and cloud metadata endpoints , enabling enumeration o...

EUVD-2026-71947

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

SUSE CVE-2026-6739

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-i...

EUVD-2026-71775

In Ignition 8.1.53 and earlier, the Gateway "Create Project Roles" setting shipped blank, which permitted any authenticated user to create projects if they can execute gateway scripts. Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3...

CVE-2026-86178: Missing Authorization

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

CVE-2026-86122: Server-Side Request Forgery (SSRF)

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...

CVE-2026-77393

In Ignition 8.1.53 and earlier, the Gateway "Create Project Roles" setting shipped blank, which permitted any authenticated user to create projects if they can execute gateway scripts. Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3...

CVE-2026-53769

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...