226456 matches found
PT-2026-55038
Name of the Vulnerable Software and Affected Versions ez Form Calculator Premium versions prior to 2.14.1.3 Description The plugin contains a broken access control issue that allows unauthenticated users to bypass authorization restrictions. Recommendations Update to a version newer than 2.14.1.2...
PT-2026-55030
Subscriber Broken Access Control in Werkstatt = 4.7.2 versions...
MAL-2026-6776 Malicious code in @marketfront/dynamicpageparams (npm)
The @marketfront/dynamicpageparams package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and u...
CVE-2026-38971
ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCSMAVLink/GCSserialcontrol.cpp in GCSMAVLINK::handleserialcontrol...
PT-2026-54960
Unauthenticated Broken Access Control in Woostify Sites Library = 1.6.2 versions...
PT-2026-55236
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device...
CVE-2026-38971
CVE-2026-38971 affects ArduPilot through Plane-4.6.3. It is a real vulnerability: an out-of-bounds read in libraries/GCS_MAVLink/GCS_serial_control.cpp, within GCS_MAVLINK::handle_serial_control(). The CVSS 3.1 vector indicates no authentication, network attack surface, low attack complexity, and...
ROS-20260702-73-0084
The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260702-73-0044
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
Уязвимость компонента Extensions браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю обойти ограничения безопасности
Уязвимость компонента Extensions браузеров Google Chrome и Microsoft Edge связана с недостатками контроля доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти ограничения безопасности путем загрузки вредоносного расширения...
MAL-2026-6785 Malicious code in @marketfront/madvpopup (npm)
The @marketfront/madvpopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
MAL-2026-6769 Malicious code in @marketfront/captchaservice (npm)
The @marketfront/captchaservice package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
ROS-20260702-73-0068
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
The fix for CVE-2026-46339 unauthenticated RCE via unprotected MCP plugin routes introduced a local-only access gate in src/dashboardGuard.js that restricts spawn-capable routes /api/mcp/, /api/tunnel/, /api/cli-tools/ to loopback requests. The gate determines "local" by inspecting the Host and...
PT-2026-54981
Name of the Vulnerable Software and Affected Versions Motors versions prior to 5.6.81 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 5.6.80...
PT-2026-54983
Unauthenticated Broken Access Control in NOWPayments for WooCommerce = 1.4.0 versions...
PT-2026-55248
Name of the Vulnerable Software and Affected Versions UniFi OS with UniFi Protect Application affected versions not specified Description An Improper Access Control issue exists in UniFi OS when used with the UniFi Protect Application. A malicious actor with network access and low privileges coul...
PT-2026-55317
Name of the Vulnerable Software and Affected Versions Azure Synapse affected versions not specified Description Improper access control allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that contains a...
MAL-2026-6782 Malicious code in @marketfront/header (npm)
The @marketfront/header package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
PT-2026-55304
Name of the Vulnerable Software and Affected Versions ardupilot versions prior to Plane-4.6.4 Description An out-of-bounds read issue exists in the GCS MAVLINK::handle serial control function within the libraries/GCS MAVLink/GCS serial control.cpp file. An out-of-bounds read occurs when a program...