PT-2026-55492

Name of the Vulnerable Software and Affected Versions ASUS Business Manager affected versions not specified Description An External Control of File Name or Path issue allows a local user to execute arbitrary code with SYSTEM privileges. This is achieved by tampering with an Inter-Process...

ROS-20260703-73-0008

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260703-73-0021

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260703-73-0014

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-55659

Name of the Vulnerable Software and Affected Versions Microsoft Edge for Android affected versions not specified Description Improper access control allows an unauthorized attacker to bypass a security feature over a network. Recommendations At the moment, there is no information about a newer...

CVE-2026-26145

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network...

CVE-2026-26145

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network...

CVE-2026-12413

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...

CVE-2026-38971

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCSMAVLink/GCSserialcontrol.cpp in GCSMAVLINK::handleserialcontrol...

External Control of File Name or Path

Overview recce is an Environment diff tool for dbt Affected versions of this package are vulnerable to External Control of File Name or Path via the query run API when configured with a DuckDB-backed project. An attacker can access or modify local files accessible to the server process, potential...

EUVD-2026-37801

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header...

GHSA-2JRW-C95W-H43G Mautic has an Authorization Bypass in API v2 Endpoints

Summary An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints utilizing API Platform. Under certain conditions, roles configured with owner-scope restrictions such as viewown or editown are not properly enforced. This allows low-privilege authenticated API users to bypass...

EUVD-2026-41429

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

CVE-2026-59098 LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

CVE-2026-59098 LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

CVE-2026-59098

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

GHSA-43CQ-C2GQ-PFPW Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Summary The EntriesController::actionMoveToSection endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current secti...

CVE-2026-38057

creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:11+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01 2026-07-10 21:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd56jbznv2f 2026-07-12 11:00:54+00:00| seen|...

CVE-2026-54477

creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:07+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03 2026-07-03 02:37:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppjau64lu2s 2026-07-03 18:59:03+00:00| seen|...

CVE-2026-13768

creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:03+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03 2026-07-03 00:00:42+00:00| seen| https://infosec.exchange/users/offseq/statuses/116853102484273046 2026-07-03 00:00:46+00:00| seen|...