EUVD-2026-49196

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...

CVE-2026-65878 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...

CVE-2026-65878

CVE-2026-65878 concerns the Joomla Extension from joomshaper.com, specifically SP Page Builder versions earlier than 6.7.1. The issue arises from improper path validation and ACL checks, creating a vector for authenticated users to perform arbitrary file deletion via the media manager. This is an...

CVE-2026-59690 Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

CVE-2026-59689

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system...

EUVD-2026-49186

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...

CVE-2026-59688

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...

EUVD-2026-49185

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location...

EUVD-2026-49184

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

CVE-2026-59686

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

CVE-2026-59686 Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

CVE-2026-64437

A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an authenticated client using the Server Message Block SMB protocol to trigger a use-after-free error. By sending specific close and cancel requests, an attacker can cause the kernel to crash, leading to a deni...

CVE-2026-64398

A flaw was found in the Linux kernel's ksmbd component. An authenticated Server Message Block SMB client with only FILEWRITEATTRIBUTES permission can bypass a security check in the FSCTLSETZERODATA function. This allows the client to zero out file data, leading to data destruction and a denial of...

EUVD-2026-49063

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

PT-2026-65115

Name of the Vulnerable Software and Affected Versions JFrog Platform affected versions not specified Description An authorization flaw allows an authenticated user to perform privilege escalation under admin-provisioned account conditions. Successful exploitation of this issue may grant the...

PT-2026-65081

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 Devolutions Server versions 2026.1.23.0 and earlier Description Improper access control in the NetBox synchronizer allows an authenticated user with view-only permission on an entry to...

PT-2026-64902

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress Software ECS Connection Manager affected versions not specified Progress Software Object Scale Connection Manager affected versions not specified Progress Software MOVEit WA...

Linux Distros Unpatched Vulnerability : CVE-2026-13055

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound...

Linux Distros Unpatched Vulnerability : CVE-2026-13077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of- bounds heap read via a crafted aggregation pipeline. Th...