The vulnerability of the graphical user interface of Kaspersky Endpoint Security’s antivirus protection allows a hacker to bypass existing security mechanisms and cause a partial failure in service delivery.

The vulnerability of the graphical user interface of Kaspersky Endpoint Security’s antivirus protection for Windows relates to insecure temporary files. Exploiting this vulnerability can allow a malicious actor to bypass existing security mechanisms and cause partial service interruption...

PUB-A-513139951

In CPM, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-38577

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

EUVD-2026-68767

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic...

CVE-2026-12894

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-82862

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

EUVD-2026-68407

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in...

CVE-2026-82346: Creation of Temporary File in Directory with Insecure Permissions

A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...

CVE-2026-38577

The Tenda HG21 (XPON Fiber Modem) , specifically version V4.0.0-260302 (Product Key: HG21-V1.0-TDE01 , Hardware Version: V1.0 ), is vulnerable to the use of hardcoded credentials (CWE-798) in the shipped firmware. Firmware analysis reveals a static admin account with a password hash resolving to ...

CVE-2026-38577

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

EUVD-2026-68879

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

Security update for librest (moderate)

openSUSE security update: security update for librest ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21694-1 Rating: moderate References: bsc1272399 Cross-References: CVE-2026-16615 CVSS scores: CVE-2026-16615 SUSE : 6.8...

The vulnerability of the ImageCapture component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the ImageCapture component in Google Chrome and Microsoft Edge browsers is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially crafted HTML page...

VIBE-VAULT

⚡ VibeVault: OWASP Top 10 Web Security & Patching Lab VibeV...

SUSE-SU-2026:23564-1 Security update for librest

This update for librest fixes the following issue: - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399...

OPENSUSE-SU-2026:21694-1 Security update for librest

This update for librest fixes the following issue: - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399...

EUVD-2026-68063

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

EUVD-2026-68059

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

EUVD-2026-68051

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...