CVE-2026-105977

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...

CLEANSTART-2026-UI77772 Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team,...

Security vulnerability affects the airflow-3 package. Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site...

GHSA-FMMF-XQ98-G327 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...

CVE-2026-107854

The Jexactyl game management and billing system (versions 4.0.0 to 4.0.5 ) contains an authorization bypass vulnerability in the POST /api/client/billing/free/process endpoint. The application fails to verify ownership when processing a client-controlled server_id , allowing an authenticated user...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

CVE-2026-107843

The Contao Open Source CMS (versions 4.1.0 through 5.3.50 and 5.7.12 ) contains a vulnerability where the ModuleRegistration::compile() function fails to verify FORM_SUBMIT or captcha results on unauthenticated POST requests. This allows an unauthenticated attacker to trigger the resendActivation...

CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...

CVE-2026-15340

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

CVE-2026-29797 Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP...

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

EUVD-2026-95694

The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...

CVE-2026-71575 Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...

CVE-2026-78017

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 are susceptible to an Improper Check for Unusual or Exceptional Conditions vulnerability (CWE-754). A high privileged attacker with remote access could exploit this flaw to achieve Information tampering and a Protection...

CVE-2026-106095

The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite...

EUVD-2026-95506

The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite...

CVE-2026-106095

The Code Snippets WordPress plugin in versions before 3.10.0 is vulnerable to a privilege escalation issue due to a missing capability check on a snippet-management action. The application incorrectly derives the network scope of a targeted snippet from the request rather than the stored record. ...

CVE-2026-106095 Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet

The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite...

CVE-2026-69098_exploit

CVE-2026-69098 — kotaemon unauthenticated deserialization RCE Unauthenticated remote code execution in kotaemon = 0.12.0 via insecure deserialization in the LLM-settings connection check. The bug kotaemon's LLM-settings checkconnection Gradio handler libs/ktem/ktem/llms/ui.py parses an...

CLEANSTART-2026-XM64150 IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen

Security vulnerability affects the php package. The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen...