PT-2026-99060

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description Insufficient authorization checks exist within the FormThemeController write endpoints for global form themes and categories. This allows authenticated users without administrative privileges...

PT-2026-98947

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Zammad versions prior to 7.1.0 Description Zammad is a web-based open source helpdesk and customer support system. The issue involves a lack of discursive validation within the authorization cascade, where...

openSUSE 16 Security Update : distribution (openSUSE-SU-2026:21898-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21898-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the...

Fedora 45 : chromium (2026-735231f9e0)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-735231f9e0 advisory. Update to 154.0.8037.57 CVE-2026-95274: Improper output encoding in DevTools CVE-2026-95275: Incorrect reference resolution in MediaStream...

CVE-2026-85491

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-87720

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-87720

A vulnerability exists in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 due to Incorrect Authorization (CWE-863) . The flaw stems from project name normalization in ProjectUtil.stripGitSuffix and eviction logic in ProjectCacheImpl. Specificall...

CVE-2026-87720

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-85491

The Catalyst::Seal library for Perl (versions before 0.03 ) contains a vulnerability where a dispatch memo is keyed solely on the request path. Because the memo does not account for state such as HTTP methods, content types, or schemes, it can provide incorrect resolution results for subsequent r...

CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-97368

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-97368 chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-97368 chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-97368

A weakness exists in chillzhuang SpringBlade versions up to 5.0.2 , specifically within the UserServiceImpl.userInfo function located in the blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java file of the user-auth-info Endpoint . An attacker can remo...

EUVD-2026-86467

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-97324

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...

CVE-2026-84399

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...