PT-2026-103202

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

CVE-2026-94499: Missing Authorization

Subscriber Broken Access Control in FormGent = 1.12.2 versions...

PT-2026-103006

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information...

PT-2026-103258

Contributor Broken Access Control in The Events Calendar = 6.17.5 versions...

ROS-20260930-73-0065

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-103177

Subscriber Broken Access Control in FormGent = 1.12.2 versions...

ROS-20260930-73-0077

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-102132: Improper Access Control

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system...

PT-2026-103491

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-47492: Missing Authorization

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service...

ROS-20260930-73-0093

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ABSENTIA: Detecting Broken Access Control Vulnerabilities in Web Applications

Broken access control, the failure of authorization, is one of the most prevalent web security risks. Unlike injection, a flow of untrusted input into a dangerous operation, authorization is a relation: who may act on what, not how data moves. Each application decides that relation for itself, so...

PT-2026-103243

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

AlmaLinux 9.2 [TuxCare] Security Update: cpio Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787337004)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787337004 advisory. - GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca t...

Rocky Linux 9.6 [TuxCare] Security Update: cpio Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787310466)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787310466 advisory. - GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca...

CVE-2026-103442: External Control of System or Configuration Setting

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

CVE-2026-94074: Missing Authorization

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-103042

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-103042

LightLLM through version 1.2.0 is susceptible to a memory exhaustion vulnerability within the NCCL control channel. When the system is started with the --pd_trans_mode nccl flag, unauthenticated attackers can exploit the exposed exposed_set_value method. Because this method lacks size limits, it ...