CVE-2026-76142

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

EUVD-2026-90484

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

CVE-2026-76142 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

CVE-2026-76142 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

CVE-2026-76142

The Genian NAC/ZTNA policy server is vulnerable to improper access control due to insufficient authentication on its internal-only IPC SOAP endpoint . An unauthenticated attacker can exploit this flaw to invoke internal functions, potentially leading to high impact on integrity and availability ....

CVE-2026-103534 David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...

CVE-2026-62073: Missing Authorization

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

CVE-2026-102370: On-Chip Debug and Test Interface With Improper Access Control

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...

CVE-2026-51895

Ragflow versions 0.24.0 and prior are affected by an improper access control vulnerability within the update_metadata_setting function located in api/apps/kb_app.py. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossing operations, depending on the specific expo...

Rocky Linux 10.0 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_15095)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202515095 advisory. httpd: insufficient escaping of user-supplied data in modssl CVE-2024-47252 httpd: modssl: access control bypass by trusted clients is possible using T...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2025:1764716872)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764716872 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule...

CentOS Linux 7 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS7:CLSA-2023:1697135138)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2023:1697135138 advisory. - The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is on...

Rocky Linux 8 [CIQ] Security Update: keepalived / keepalived-debuginfo / keepalived-debugsource (crlsa-2022_1930)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221930 advisory. keepalived: dbus access control bypass CVE-2021-44225 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessu...

Rocky Linux 8 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2024_1751)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241751 advisory. A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuratio...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2023_4541)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234541 advisory. kernel: use-after-free in l2capconnect and l2capleconnectreq in net/bluetooth/l2capcore.c CVE-2022-42896 kernel: tcindex: use-after-free vulnerability in...

PT-2026-103806

Name of the Vulnerable Software and Affected Versions Ghost versions 5.3.0 through 6.57.0 Description Ghost fails to properly enforce access controls on comments when operating in private mode. This allows unauthenticated visitors to bypass privacy settings and read comments that should be...

PT-2026-105482

Summary /api/storage/getOutlineStorage is registered with CheckAuth only and performs no authorization of any kind. Given a document identifier it returns that document's stored outline state, regardless of the document's publish tier. The two write endpoints for the same data, setOutlineStorage...

PT-2026-104006

Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description The WebSocket Application Programming Interface lacks rate limiting on authentication requests. This deficiency allows an attacker to perform brute-force attacks to obtain unauthorized acce...

Important: kernel

Issue Overview: An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a guest virtual machine to send specially crafted network packets that corrupt host kernel memory on KVM-based hypervisors running unpatched Linux kernel versions 4.4...

PT-2026-104004

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description WebSocket endpoints lack proper authentication mechanisms, which allows attackers to impersonate charging stations. This flaw enables unauthorized access to...