EUVD-2026-60584

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...

CVE-2026-74903

SiYuan before v3.7.4 has an insufficient access control flaw in the /api/lute/spinBlockDOM endpoint, guarded only by CheckAuth middleware rather than CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke it to transform arbitrary DOM input, a...

CVE-2026-72199

A flaw was found in the NTFS filesystem driver of the Linux kernel. This vulnerability arises from insufficient validation of resident index root values during lookup operations. An attacker could potentially craft a malicious NTFS filesystem that, when processed by the kernel, leads to...

CVE-2026-65331

creationtimestamp| type| source ---|---|--- 2026-08-18 04:49:30+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260818 2026-09-15 20:45:51+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19 2026-09-16 22:01:14+00:00|...

VMware ESX 8.0 / 9.0 / 9.1 Insufficient Logging (VMSA-2026-0006)

The version of VMware ESX installed on the remote host is 8.0 prior to build 25429389 8.0 Update 3j, or 9.0 prior to build 25595025 9.0.2.0100, or 9.1 prior to build 25370933 9.1.0.0. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware ESX contai...

tailscale -- Insufficient validation of 4via6 subnet router destinations

Tailscale team reports: Insufficient validation of 4via6 subnet router destinations permitted access to host-scoped addresses, including cloud metadata and loopback services. TS-2026-11...

PT-2026-77197

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description Insufficient state checks create a vector that allows an attacker to bypass Multi-Factor Authentication MFA checks, which are used to verify a user...

ROS-20260818-73-0009

The vulnerability in Portainer-Ce is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-77136

Name of the Vulnerable Software and Affected Versions Dell Watchdog Timer Driver versions prior to 2.0.0.1 Description An Exposed IOCTL Input/Output Control with insufficient access control allows a low privileged attacker with local access to potentially achieve privilege escalation. IOCTL is a...

CVE-2026-72119

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. This vulnerability arises from a race condition where CAN frame data and timer updates can be observed in a partially updated or unvalidated state due to insufficient locking. Additionally, a missing...

CVE-2026-9816

Mattermost 11.7.x (≤11.7.6), 10.11.x (≤10.11.21), and 11.8.x (≤11.8.3) lack server-side validation of BoardMember.Scheme* fields on insert and archive-import paths, allowing board editors or non-guest team members to grant Board Admin to arbitrary users via POST /api/v2/boards/{boardID}/members a...

CGA-359Q-8CFM-76R3

Bulletin has no description...

CVE-2026-15748

creationtimestamp| type| source ---|---|--- 2026-08-17 20:05:36+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mtcisrxz2p2u 2026-08-17 22:00:44+00:00| seen| https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html 2026-08-18 01:00:32+00:00| seen|...

CVE-2026-71203

creationtimestamp| type| source ---|---|--- 2026-08-17 18:00:04+00:00| seen| Telegram/hDDilD4Zf9-gI1Gn10sykTtiK4LT5Zn07fv0DMntTOtvA 2026-08-18 00:00:12+00:00| published-proof-of-concept| Telegram/hDDilD4Zf9-gI1Gn10sykTtiK4LT5Zn07fv0DMntTOtvA 2026-08-22 19:00:07+00:00| seen|...

CVE-2026-72303

A flaw was found in the ASoC Sound Open Firmware SOF ipc4-control component of the Linux kernel. This vulnerability arises from insufficient validation of the MODULENOTIFICATION payload length when handling control updates. An attacker could potentially exploit this by providing a malformed...

CVE-2026-70412

creationtimestamp| type| source ---|---|--- 2026-08-17 13:47:19+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtbtoejirt2o 2026-08-17 14:06:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jyn2go5y64m3t...

UBUNTU-CVE-2026-75006

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...

CVE-2026-14564 Sensitive Data Exposure in Innotim Software's Logsign SIEM

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

EUVD-2026-60161

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

CVE-2026-74895

creationtimestamp| type| source ---|---|--- 2026-08-17 12:10:19+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtboauu7st2b 2026-08-17 12:48:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5wvod3x3ygyvu 2026-08-17 19:10:04+00:00| seen|...