Docker Control System Record-Output Command Execution

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager is related to improper external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to...

ROS-20260928-73-0112

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-80357: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80359: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-15953: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...

CVE-2026-101054: Improper Access Control

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function getfile of the file /tmp/wpasupplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available...

PT-2026-99936

Name of the Vulnerable Software and Affected Versions WatchGuard Access Points affected versions not specified Description An improper access control issue exists within an internal API service. This allows an unauthenticated attacker with network access to the access point to obtain a valid API...

PT-2026-99901

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

PT-2026-99958

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

PT-2026-102396

Name of the Vulnerable Software and Affected Versions Nginx Proxy Manager versions prior to 2.16.1 Description Lack of rate-limiting on authentication endpoints allows unauthenticated attackers to perform unlimited password guessing against any account. Attackers can brute-force login credentials...

PT-2026-99911

Name of the Vulnerable Software and Affected Versions Dell Boot Optimized Server Storage BOSS versions prior to 2.2.13.2038 Description The SMCU on 17G BOSS-N1 controllers contains an On-Chip Debug and Test Interface with improper access control. An unauthenticated attacker with physical access t...

PT-2026-99873

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description Insufficient access control in the HA failover endpoint allows for destructive PostgreSQL database operations, which can lead to complete data destruction. Recommendations Update...

INTCC: A Framework for Interactive Confidential Computing

Confidential computing leverages Trusted Execution Environments TEEs to ensure the confidentiality and integrity of data in use. However, TEEs rely on remote attestation to guarantee the integrity of their initial memory state. This model is fundamentally at odds with interactive development...

CVE-2026-54160: Inclusion of Functionality from Untrusted Control Sphere

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

Incus Arbitrary Command Execution

The vulnerability of the container management system and the virtual machine manager Incus is related to improper external control of the file name or path. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Incus Arbitrary Command Execution

The vulnerability of the container management system and the virtual machine manager Incus is related to improper external control of the file name or path. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-100884

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...

CVE-2026-100883

A vulnerability exists in Krayin laravel-crm versions up to 2.2.5 due to a flaw in an unknown function within the file packages/Webkul/Admin/src/Config/acl.php. This flaw allows for improper access controls through remote manipulation. The documents state that an exploit has been published and ma...

CVE-2026-100883 Krayin laravel-crm acl.php access control

A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be...

CVE-2026-100883 Krayin laravel-crm acl.php access control

A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be...