PT-2026-69992

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description Insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. This flaw enables an attacker to perform administrative actions...

Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks

Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical. Existing methods typically...

EUVD-2026-54743

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

CVE-2026-16948

The Solace Extra WordPress plugin versions prior to 1.6.1 are vulnerable to improper access control. The root cause is a failure to perform capability checks in several AJAX actions , coupled with the exposure of the protecting nonce on admin pages accessible to low-privileged users. This allows ...

CVE-2026-56794

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

CVE-2026-56794

CVE-2026-56794 affects Dell OpenManage Server Administrator, prior to version 11.1.0.2. It is a Relative Path Traversal vulnerability that could be exploited by a low-privileged attacker with remote network access to gain filesystem access. The provided metrics assign a CVSS v3.1 base score of 6....

EUVD-2025-210644

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

Cisco Catalyst 8000V Heap Buffer Overflow

An authenticated heap buffer overflow in Cisco Catalyst 8000V sd-wan allows an attacker with low privileges to corrupt process memory and achieve remote code execution...

CVE-2026-56794: Relative Path Traversal

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

CVE-2025-15674

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

GHSA-2RP4-X2J7-QMCC Craft CMS: Stored XSS in the control panel via unescaped draft name

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...

CVE-2025-15674 Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2025-15674 Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2025-15674

Passster (WordPress plugin) before 4.3.7 allows low-privilege users with edit_posts capability to read globally password-protected content via the WordPress REST API when global protection is enabled. Any Contributor or higher can access protected pages/posts without the password. A fix is availa...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.95 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.95 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.95 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.95 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

CVE-2026-1728

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...

EUVD-2026-53821

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...

CVE-2026-1728

CVE-2026-1728 affects WSO2 products. Tokens issued to low-privilege users are not sufficiently restricted, enabling access to product-level Admin REST APIs and potentially enabling full administrative account takeover. Affected component is the token/session handling that can be exploited to invo...