CVE-2026-75907

The door access control system on Norwegian Cruise Line assets is vulnerable to improper authentication because it grants entry based solely on the static 7-byte UID of an NTAG212 NFC chip . Since the UID is a manufacturer serial number sent in the clear and lacks challenge-response capabilities ...

EUVD-2026-86156

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

CVE-2026-93282

The Linux kernel 's ksmbd component contains a flaw in how it performs maximum allowed access checks for SMB2. The DACL permission check failed to consider the Authenticated Users ACE (S-1-5-11), leading to incorrect STATUS_ACCESS_DENIED errors for authorized sessions. Additionally, the system in...

CVE-2026-66069

A flaw was found in RabbitMQ. A user with a monitoring tag, when the Management plugin is enabled, can reset the per-node authentication-attempt counters. This action, which should be restricted to administrators, allows the monitoring-tagged user to erase evidence of brute-force login attempts...

OpenAI agent breached Australian government site, took months to report it

An OpenAI agent didn’t take “no” for an answer when it encountered a government website’s access controls. It got through, prompting Australia’s Prime Minister Anthony Albanese to raise his concerns directly with OpenAI CEO Sam Altman. The BBC reports that an OpenAI agent gained unauthorized acce...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mor Golan in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.29...

WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Bookly versions = 28.2...

WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Blocksy Companion versions = 2.1.55...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a malicious file. Chromium security severity: Medium...

CVE-2026-78313

Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78313

The DIAEnergie software is affected by an Improper Access Control vulnerability in versions before 1.11.00.022 . While the specific root cause is not detailed in the provided documents, the vulnerability allows for a HIGH confidentiality impact. The CVSS v3.1 score is 6.5 (MEDIUM) , with a networ...

CVE-2026-78313 Improper Access Control in DIAEnergie

Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78313 Improper Access Control in DIAEnergie

Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

EUVD-2026-85823

Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

A flaw was found in the Linux kernel's Sound Open Firmware SOF subsystem, specifically within the ipc3-control component. This vulnerability occurs in the sndsofupdatecontrol function where the size of firmware-provided data is not properly validated against the allocated buffer size. An attacker...

Moderate: Red Hat Security Advisory: libsoup3 security update

An update for libsoup3 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...

OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files

An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and...

CVE-2026-82849

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...