CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-104076 TVU Networks Receiver/Transceiver Missing Authentication via REST API

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...

CVE-2026-104076

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 are vulnerable to a missing authentication flaw in their REST API endpoints on port 8288 . Remote unauthenticated attackers can exploit this to read sensitive device information, including network configurations and fir...

CVE-2026-85421

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

CVE-2026-104076: Missing Authentication for Critical Function

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...

PT-2026-108188

Name of the Vulnerable Software and Affected Versions TVU Networks Receiver/Transceiver devices versions prior to 7.9 Description Remote unauthenticated attackers can read sensitive device information and modify device configuration due to missing authentication on REST API endpoints on port 8288...

CVE-2026-104678

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

EUVD-2026-94183

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

PT-2026-107406

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

Rocky Linux 8 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2024_1751)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241751 advisory. A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuratio...

Rocky Linux 8 [CIQ] Security Update: dnf-plugin-subscription-manager / etc (crlsa-2023_4706)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234706 advisory. subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration CVE-2023-3899 Tenable has extracted th...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (CENTOS-STREAM8:CLSA-2026:1768395381)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1768395381 advisory. - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the...

Botslab G980H Dashcams

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device operation. 2. RECOMMENDED PRACTICES CISA...

CVE-2026-95985: Inclusion of Functionality from Untrusted Control Sphere

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

CVE-2026-18185

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

EUVD-2026-85351

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2026-18185

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18185 , which stems from missing authentication for a critical function (CWE-306). A remote attacker could exploit this flaw to access sensitive information and modify system configurations . The vulnerability im...

CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2026-87981 Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...