EUVD-2026-72757

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query t...

CVE-2026-73320 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query t...

EUVD-2026-72662

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A random number generator is used to generate security-relevant values such as session identifiers used for authentication purposes that is not initialized with a True Random Number Generator TRNG, resulting in a predictable...

CVE-2026-73320: Authorization Bypass Through User-Controlled Key

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query t...

PT-2026-87125

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86994: Missing Authorization

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...

CVE-2026-86113

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the editreadthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and...

EUVD-2026-71945

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the editreadthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and...

CVE-2026-86113 BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the editreadthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and...

CVE-2026-86113

BookWyrm through version 0.9.1 is affected by an authorization bypass (Insecure Direct Object Reference) in the edit_readthrough function. Because ReadThrough IDs are sequential, any authenticated user can overwrite other users' start dates, finish dates, progress, and progress mode, corrupting r...

CVE-2026-86113 BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the editreadthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and...

CVE-2026-86111 BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

CVE-2026-86111: Authorization Bypass Through User-Controlled Key

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

PT-2026-86384

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and...

SUSE-SU-2026:23625-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5026 CVE-2026-39821 GO-2026-6225 GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw...

OPENSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5026 CVE-2026-39821 GO-2026-6225 GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw...

CVE-2026-85392 Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling...

CVE-2026-84674: Missing Authorization

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

Evaluating ML-Based Intrusion Detection Systems: The Illusion of Model Efficacy

Intrusion Detection has been revolutionized due to the integration of Machine Learning. Improved detection rates, reduced false alarms, and optimized algorithms contribute to the perception of improved systems with optimal accuracy and near-perfect performance, the illusion of model efficacy...

libssh: libssh: denial of service via SFTP responses with unknown request IDs

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service...