CVE

Control Tower Notification Enabler Este paquete cdk instala una función Lambda, con un rol IAM asociado, y suscribe la función Lambda a las notificaciones de seguridad agregadas de Control Tower. En caso de una violación de una regla de Control Tower por ejemplo, un bucket S3 de acceso público, l...

INTCC: A Framework for Interactive Confidential Computing

Confidential computing leverages Trusted Execution Environments TEEs to ensure the confidentiality and integrity of data in use. However, TEEs rely on remote attestation to guarantee the integrity of their initial memory state. This model is fundamentally at odds with interactive development...

CVE-2026-101144: Improper Access Control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2026-54674: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-12265: Improper Access Control

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-102334: Improper Restriction of Excessive Authentication Attempts

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

Incus Arbitrary Command Execution

The vulnerability of the container management system and the virtual machine manager Incus is related to improper external control of the file name or path. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Docker Control System Record-Output Command Execution

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager is related to improper external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to...

Incus Arbitrary Command Execution

The vulnerability of the container management system and the virtual machine manager Incus is related to improper external control of the file name or path. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

OpenBao secret encryption management system Privilege Escalation

The vulnerability of the OpenBao encryption and secret management system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

PT-2026-99873

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description Insufficient access control in the HA failover endpoint allows for destructive PostgreSQL database operations, which can lead to complete data destruction. Recommendations Update...

CVE-2026-54160: Inclusion of Functionality from Untrusted Control Sphere

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

PT-2026-99885

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...

PT-2026-99936

Name of the Vulnerable Software and Affected Versions WatchGuard Access Points affected versions not specified Description An improper access control issue exists within an internal API service. This allows an unauthenticated attacker with network access to the access point to obtain a valid API...

PT-2026-102396

Name of the Vulnerable Software and Affected Versions Nginx Proxy Manager versions prior to 2.16.1 Description Lack of rate-limiting on authentication endpoints allows unauthenticated attackers to perform unlimited password guessing against any account. Attackers can brute-force login credentials...

CVE-2026-101054: Improper Access Control

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function getfile of the file /tmp/wpasupplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available...

PT-2026-99856

Name of the Vulnerable Software and Affected Versions Thinkware U3000 versions prior to 1.02.04 Description Improper access controls exist within the TCP Service component. A remote attacker can manipulate the get file function associated with the /tmp/wpa supplicant.conf file to gain unauthorize...

Continuous Assurance of Agentic Security Auditors for Software Delivery Decision Gates

Large language model LLM-based repository auditors are increasingly deployed as security controls within continuous integration CI pipelines, where their findings admit, block, or delay software changes. As Agentic Software Development Life Cycle SDLC Security Controls, their non-deterministic...

CVE-2026-101891: Improper Access Control

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-15953: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...