CVE-2026-68493

CVE-2026-68493 describes a vulnerability where, after guessing a 62¹⁵ complex unique identifier , a malicious logged-in user could retrieve a list of memberships for a circle they are not a member of. The CVSS 3.0 base score is 3.1 (Low) , reflecting high attack complexity and low confidentiality...

CVE-2026-82980

CVE-2026-82980 affects a WebDAV (DAV) plugin where file paths are resolved from the absolute request URI without verifying that the path segment matches the authenticated session user. This allows any authenticated user to perform cross-user manual locks on files they do not own, blocking writes ...

EUVD-2026-82615

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2025-69295

CVE-2025-69295 — TeconceTheme Coven Core Blind SQL Injection Vulnerability CVE-2025-69295 is a SQL Injection vulnerability affecting the Coven Core component of the TeconceTheme Coven Core WordPress theme. The vulnerability exists due to improper neutralization of user-supplied input before it is...

EUVD-2026-82600

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

EUVD-2026-82608

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

EUVD-2026-82587

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

EUVD-2026-82582

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

CVE-2026-85887

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

CVE-2026-18441

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-84239: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command...

CVE-2026-40537: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2025-33147: Use of a Broken or Risky Cryptographic Algorithm

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication...

ROS-20260918-73-0025

The vulnerability of the ip6errgenicmpv6unreach function in the net/ipv6/icmp.c module of the Linux operating system is related to access to resources through incompatible types. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause...

CVE-2026-11726: Out-of-bounds Read

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values...

CVE-2026-18441: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-1030: Generation of Error Message Containing Sensitive Information

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data...

CVE-2026-11545: Missing Authorization

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks...