CVE-2026-61407

Dell Watchdog Timer Driver versions before 2.0.0.1 expose an IOCTL interface lacking proper access controls. A locally authenticated low-privilege attacker can call this IOCTL to escalate privileges, achieving high confidentiality, integrity, and availability impact (CVSS 8.8). The fix is to upgr...

EUVD-2026-60940

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

CVE-2026-61407

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

CVE-2026-75832

creationtimestamp| type| source ---|---|--- 2026-08-18 13:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mteec6zzp323 2026-08-18 14:07:44+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtefbrptnq2y...

CVE-2026-74903

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...

EUVD-2026-60584

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...

CVE-2026-74903 SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...

CVE-2026-74903

SiYuan before v3.7.4 has an insufficient access control flaw in the /api/lute/spinBlockDOM endpoint, guarded only by CheckAuth middleware rather than CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke it to transform arbitrary DOM input, a...

CVE-2026-72199

A flaw was found in the NTFS filesystem driver of the Linux kernel. This vulnerability arises from insufficient validation of resident index root values during lookup operations. An attacker could potentially craft a malicious NTFS filesystem that, when processed by the kernel, leads to...

CVE-2026-65331

creationtimestamp| type| source ---|---|--- 2026-08-18 04:49:30+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260818...

VMware ESX 8.0 / 9.0 / 9.1 Insufficient Logging (VMSA-2026-0006)

The version of VMware ESX installed on the remote host is 8.0 prior to build 25429389 8.0 Update 3j, or 9.0 prior to build 25595025 9.0.2.0100, or 9.1 prior to build 25370933 9.1.0.0. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware ESX contai...

PT-2026-77197

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

PT-2026-77136

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

CVE-2026-72119

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. This vulnerability arises from a race condition where CAN frame data and timer updates can be observed in a partially updated or unvalidated state due to insufficient locking. Additionally, a missing...

CVE-2026-9816

Mattermost 11.7.x (≤11.7.6), 10.11.x (≤10.11.21), and 11.8.x (≤11.8.3) lack server-side validation of BoardMember.Scheme* fields on insert and archive-import paths, allowing board editors or non-guest team members to grant Board Admin to arbitrary users via POST /api/v2/boards/{boardID}/members a...

CVE-2026-15748

creationtimestamp| type| source ---|---|--- 2026-08-17 20:05:36+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mtcisrxz2p2u 2026-08-17 22:00:44+00:00| seen| https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html 2026-08-18 01:00:32+00:00| seen|...

CVE-2026-71203

creationtimestamp| type| source ---|---|--- 2026-08-17 18:00:04+00:00| seen| Telegram/hDDilD4Zf9-gI1Gn10sykTtiK4LT5Zn07fv0DMntTOtvA 2026-08-18 00:00:12+00:00| published-proof-of-concept| Telegram/hDDilD4Zf9-gI1Gn10sykTtiK4LT5Zn07fv0DMntTOtvA...

CVE-2026-72303

A flaw was found in the ASoC Sound Open Firmware SOF ipc4-control component of the Linux kernel. This vulnerability arises from insufficient validation of the MODULENOTIFICATION payload length when handling control updates. An attacker could potentially exploit this by providing a malformed...

CVE-2026-70412

creationtimestamp| type| source ---|---|--- 2026-08-17 13:47:19+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtbtoejirt2o 2026-08-17 14:06:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jyn2go5y64m3t...

UBUNTU-CVE-2026-75006

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...