The vulnerability of the upload component in the /photo_center/php/uploadify.php file of the D-Link DNS-320 network storage software allows a hacker to cause a service failure.

The vulnerability of the /photocenter/php/uploadify.php component in the D-Link DNS-320 network storage software is related to errors in access control when processing the “Malicious Handler” parameter. Exploiting this vulnerability allows an attacker to cause service failures...

ALSA-2026:42736 Important: acl security update

Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fixes: acl: Symlink traversal privilege escalation via libacl function...

PT-2026-61976

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description Broken access control allows arbitrary file read and write operations. This flaw can be leveraged to escalate privileges and execute code as root. Exploitation requires domain...

PT-2026-62049

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An Unintended Proxy or Intermediary issue, also known as a Confused Deputy, occurs when a lower-privileged user can manipulate the system to process data from unauthorized sources using the...

PT-2026-61829

Name of the Vulnerable Software and Affected Versions kronosnet versions prior to 1.35 Description An issue exists in the internal Access Control List ACL subsystem. When the framework is configured to manage dynamic links to accept network traffic from any IP address without network payload...

RHEL 10 : acl (RHSA-2026:42739)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42739 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain...

RHEL 9 : acl (RHSA-2026:42736)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42736 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain t...

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that its sibli...

PT-2026-63289

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authorization issue exists in the organization-level Actions REST endpoints. The endpoints /api/v1/orgs/org/actions/runs and /api/v1/orgs/org/actions/jobs only verify organization membership...

PT-2026-62094

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Improper Access Control allows a low-privileged authenticated user with read-only Security Solution access to perform write operations on Entity Analytics Watchlist configuration, which should...

PT-2026-61968

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description Broken access control allows a domain administrator to create system administrator accounts. The impact of this issue is lower in Windows deployments. Recommendations At the moment,...

MiracleLinux 8 : kernel-4.18.0-553.141.2.el8_10 (AXSA:2026-1311:50)

"The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1311:50 advisory. kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable...

CVE-2026-47255

The CVE-2026-47255 entry concerns AgenticMail API/core vulnerabilities in versions prior to 0.9.32 and 0.9.10, respectively. The connected documents specify multiple hardening and validation weaknesses across storage and outbound relay handling, including: (1) validation and binding of inactive-a...

CVE-2026-47255 AgenticMail API/storage and outbound relay hardening

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...

CVE-2026-47134 ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database /Library/Application Support/clearancekit/store.db is stored in the macOS System Keychain. The key was created via the two-step patte...

CVE-2026-47129

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

CVE-2026-47130

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-55544

NextCRM (open-source) vulnerability CVE-2026-55544 affects version 0.12.1, where MCP campaign tools expose read/write operations over the network via user-generated Bearer tokens (nxtc__...). Despite an authorization model restricting normal users to their own campaigns, multiple MCP handlers ign...

EUVD-2026-46109

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

CVE-2026-47129 NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...