CVE-2026-73626

CVE-2026-73626 is a HIGH severity (CVSS 3.1: 7.5) vulnerability in JupyterLab versions >=4.6.0, <=4.6.1 and

CVE-2026-59504

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59504

CWE-602: Client-Side Enforcement of Server-Side Security...

CVE-2026-59504 Priority – CWE-602: Client-Side Enforcement of Server-Side Security

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

EUVD-2026-57771

CWE-602: Client-Side Enforcement of Server-Side Security...

CVE-2026-59504 Priority – CWE-602: Client-Side Enforcement of Server-Side Security

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59504

Technical details about CVE-2026-59504 are not provided in the supplied documents. Monitor for updates as public details remain unavailable.

CVE-2026-73627: Client-Side Enforcement of Server-Side Security

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

PT-2026-71414

CWE-602: Client-Side Enforcement of Server-Side Security...

CVE-2026-59504: Client-Side Enforcement of Server-Side Security

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-73290 RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...

EUVD-2026-57229

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

Missing Authorization

Apache ActiveMQ is vulnerable to a Missing Authorization vulnerability. The vulnerability is due to temporary destination isolation being enforced only on the client side, which allows an attacker to bypass the authorization check and consume messages from another connection's temporary destinati...

EUVD-2026-57175

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-73288: Protection Mechanism Failure

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

PT-2026-71088

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS POLICY PLUGIN URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs existing object tag incorrectly for PreparedIamMode::Opa, causing maybe merg...

EUVD-2025-210719

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed from these locations...

CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

AZL-95532 CVE-2026-73283 affecting package openssh for versions less than 9.8p1-10

In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...