CVE-2026-1267

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls...

CVE-2026-4064

Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and...

CVE-2026-4064

PowerShell Universal, a platform developed by Devolutions , is vulnerable to a security flaw in versions prior to 2026.1.4 . The issue is caused by missing authorization checks on multiple gRPC service endpoints , which allows an authenticated user with a valid token to bypass role-based access c...

The vulnerability of Intel Trust Domain Extensions (TDX) microprogramming software for Intel processors allows a perpetrator to gain unauthorized access to confidential information.

The vulnerability of Intel Trust Domain Extensions TDX microprogramming software for Intel processors lies in the ability to read data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information...

PT-2026-25975

Name of the Vulnerable Software and Affected Versions Cockpit versions 2.13.4 and earlier Description Cockpit is a headless content management system. Instances running version 2.13.4 or earlier with API access enabled are susceptible to a SQL Injection issue in the MongoLite Aggregation Optimize...

PT-2026-25951

CVE-2026-1267 IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of pro… https://t.co/BQ9nfoG4xS...

ROS-20260317-73-0033

A vulnerability in the cgroup mechanism of the BPF subsystem of the Linux kernel is related to reading beyond buffer boundaries in memory. Exploitation of the vulnerability may allow an attacker to gain unauthorized access to protected information or cause denial of service...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the BucketsController-actionLoadBucketData endpoint. An attacker can retrieve a list of accessible buckets by sending a request with a valid CSRF token, even without authentication. Remediation Upgrade...

EUVD-2026-12397

Stored Cross-Site Scripting XSS vulnerability in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/configuracion/agenda/modelo-formulario-evento'. A user with permission to create personalized accounts could exploit this vulnerability simply by creating a malicious survey...

EUVD-2017-18928

Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated attackers to access sensitive information. Remote attackers can send specially crafted requests to the REST API endpoints to retrie...

CVE-2026-3024

Stored Cross-Site Scripting XSS vulnerability in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/configuracion/agenda/modelo-formulario-evento'. A user with permission to create personalized accounts could exploit this vulnerability simply by creating a malicious survey...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the tableHandWrite argument in the DDL Handler process. An attacker can access or modify sensitive data and potentially disrupt application functionality by injecting crafted SQL statements remotely. Remediation There ...

CVE-2026-3024

CVE-2026-3024 is a Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma web application, specifically at the endpoint vets.wakyma.com/configuracion/agenda/modelo-formulario-evento. The description indicates an attacker with permission to create personalized accounts can trigger a malicio...

CVE-2017-20223

CVE-2017-20223 affects the Telesquare SKT LTE Router SDT-CS3B1, firmware version 1.2.0. The vulnerability is an insecure direct object reference that allows an unauthenticated attacker to bypass authorization by manipulating user-supplied input parameters, enabling access to resources and functio...

CVE-2026-3110: Improper Access Control

Insecure Direct Object Reference IDOR vulnerability in Campus Educativa specifically at the endpoint '/administracion/adminusuarios.cgi?filtroestado=T&wAccion=listadoxlsx&wBuscar=&wFiltrar=&wOrden=altausuario&widcursoActual=ID' where the data of users enrolled in the course is exported. Successfu...

The vulnerability of the bpf component in the Linux operating system’s kernel allows a hacker to gain access to confidential data and also cause a service failure.

The vulnerability of the bpf component in the Linux operating system’s kernel is related to reading data beyond the allowed buffer limits. Exploiting this vulnerability can allow an attacker to access confidential data and also cause service interruptions...

Wakyma 跨站脚本漏洞

Wakyma is a pet management application developed by the Spanish company Wakyma. Wakyma has a cross-site scripting vulnerability. This vulnerability stems from a stored-cross-site scripting flaw in the endpoint vets.wakyma.com/configuracion/agenda/modelo-formulario-evento. It could allow users wit...

CVE-2026-3024: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/configuracion/agenda/modelo-formulario-evento'. A user with permission to create personalized accounts could exploit this vulnerability simply by creating a malicious survey...

CVE-2025-69808

An out-of-bounds memory access OOB in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of Service DoS via supplying a crafted packet...

`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

Summary The built-in sessionstatus tool did not enforce the intended session-visibility boundary. A sandboxed subagent could supply another session's sessionKey and inspect or modify state outside its own sandbox scope. Impact This allowed a sandboxed child session to read parent or sibling sessi...