EUVD-2026-74769

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

ROOT-OS-DEBIAN-12-CVE-2025-38349 CVE-2025-38349 in linux - Patched by Root

Root has patched CVE-2025-38349 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-46086 CVE-2026-46086 in linux - Patched by Root

Root has patched CVE-2026-46086 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-68369 CVE-2025-68369 in linux - Patched by Root

Root has patched CVE-2025-68369 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-46301 CVE-2026-46301 in linux - Patched by Root

Root has patched CVE-2026-46301 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-40164 CVE-2025-40164 in linux - Patched by Root

Root has patched CVE-2025-40164 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-37850 CVE-2025-37850 in linux - Patched by Root

Root has patched CVE-2025-37850 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-56742 CVE-2024-56742 in linux - Patched by Root

Root has patched CVE-2024-56742 in the linux package for Root:Debian:12. Multiple fixed versions available...

SUSE CVE-2026-55065

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...

PT-2026-88898

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-85037: Authorization Bypass Through User-Controlled Key

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

PT-2026-88874

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

PT-2026-89079

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier...

CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

CVE-2026-62647

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A random number generator is used to generate security-relevant values such as session identifiers used for authentication purposes that is not initialized with a True Random Number Generator TRNG, resulting in a predictable...

CVE-2026-62646

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

CVE-2026-62646

CVE-2026-62646 affects Reyrolle 7SR5 (all versions prior to V2.70 ), a Siemens industrial communication gateway. The vulnerability resides in the session identifier generation mechanism: an algorithm with insufficient randomness produces low-entropy tokens that can be predicted or brute-forced. A...

CVE-2026-62646: Insufficient Entropy

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier vulnerability

Unauthenticated Account Takeover via 'acfobjects' Object Identifier vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...