EUVD-2026-60610

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

SUSE CVE-2026-53789

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...

PT-2026-77206

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

PT-2026-78237

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.6.0 Description The perform-scheduled-backup IPC handler in src/ipc/storage.js fails to verify if the settings.path provided by a renderer-supplied object is within an authorized backup location. This allows a...

EUVD-2026-60243

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

BIT-MONGODB-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

PT-2026-76693

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-74562

The CVE-2026-74562 issue affects the Linux kernel nexthop code: fib6_check_nh_list() and __nexthop_replace_notify() walk the nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, while IPv6 RTM_NEWROUTE/RTM_DELROUTE can mutate that list without RTNL and race with ...

UBUNTU-CVE-2026-74273

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

CVE-2026-72072

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

CVE-2026-74314 bpf: Cancel special fields on map value recycle

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-74273

CVE-2026-74273 affects the Linux kernel’s cxl/region logic. The fix expands the range lock and renames it to a new lock called regions_lock to disable region deletion during two critical windows: between construct_region() and attach_target(), and between device_add() and registering the remove a...

PT-2026-73063

Name of the Vulnerable Software and Affected Versions code-projects Online Food Order System version 1.0 Description A flaw in the file delete food items1.php allows for remote SQL injection. This occurs when the checkbox argument is manipulated, enabling an attacker to interfere with the databas...

CVE-2026-50027

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An unauthenticated remote...

CVE-2026-50027

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An unauthenticated remote...

CVE-2026-50027

CVE-2026-50027 describes a missing authentication flaw in mcp-memory-service where all HTTP routes under /api/documents/* are accessible without credentials prior to version 10.67.1. An unauthenticated attacker can perform write, read, and delete operations on stored memories, bypassing the inten...

CVE-2026-50027 mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An unauthenticated remote...

CVE-2026-73666 OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

CVE-2026-73666

OpenChoreo OpenShift/Backstage backend vulnerability (CVE-2026-73666) affects OpenChoreo Developer Platform for Kubernetes prior to versions 1.0.4, 1.1.4, and 1.2.1. The Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDe...

CVE-2026-73653

Vitest (framework powered by Vite) has a vulnerability in Browser Mode provider commands prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6. The commands—upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces—accept browser-supplied file paths without enforcin...