CVE-2026-94499: Missing Authorization

Subscriber Broken Access Control in FormGent = 1.12.2 versions...

CVE-2026-94120: Missing Authorization

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

CVE-2026-94074: Missing Authorization

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-75824: Improper Access Control

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

ABSENTIA: Detecting Broken Access Control Vulnerabilities in Web Applications

Broken access control, the failure of authorization, is one of the most prevalent web security risks. Unlike injection, a flow of untrusted input into a dangerous operation, authorization is a relation: who may act on what, not how data moves. Each application decides that relation for itself, so...

CVE-2026-51867: Improper Access Control

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

CVE-2026-102141: External Control of File Name or Path

Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a...

PT-2026-103162

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-103442: External Control of System or Configuration Setting

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

ROS-20260930-73-0095

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0094

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-103299

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

Linux Distros Unpatched Vulnerability : CVE-2026-102253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive...

AlmaLinux 9.6 [TuxCare] Security Update: iscsi-initiator-utils / iscsi-initiator-utils-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787316164)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787316164 advisory. - An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open- iscsi allows remote MITM...

CVE-2026-103042

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-103042

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-103042

LightLLM through version 1.2.0 is susceptible to a memory exhaustion vulnerability within the NCCL control channel. When the system is started with the --pd_trans_mode nccl flag, unauthenticated attackers can exploit the exposed exposed_set_value method. Because this method lacks size limits, it ...