Oracle Access Manager Authentication Engine Full Control

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system using the HTTP network protocol...

Linux Distros Unpatched Vulnerability : CVE-2026-91840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character in...

RHEL 10 / 9 : Red Hat Edge Manager Version 1.1.4 Security Update (Important) (RHSA-2026:68334)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68334 advisory. Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports...

PT-2026-93264

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

PT-2026-93401

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with fab session backend=database. This occurs because the cleanup...

CVE-2026-86359: Incorrect Default Permissions

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-92247: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-76413: Improper Restriction of Security Token Assignment

A vulnerability in Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An...

CVE-2026-61595: Not Failing Securely

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

PT-2026-93852

Name of the Vulnerable Software and Affected Versions Dell Repository Manager versions prior to 3.5.2 Description Incorrect default permissions allow a low privileged attacker with remote access to potentially achieve elevation of privileges. Recommendations Update Dell Repository Manager to...

PT-2026-93823

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description Isolation in djust.tenants was only enforced on the HTTP path. The current tenant was stored in threading.local and set exclusively by the TenantMiddleware, which is HTTP-only. Consequently, on the liv...

CVE-2026-16794: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

CVE-2026-89328: Improper Access Control

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

CVE-2026-76186: Reliance on Cookies without Validation and Integrity Checking

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

PT-2026-93402

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Changing a user password via the Admin user-edit PATCH endpoint fails to invalidate existing database-backed sessions. This allows an attacker possessing a victim's session cooki...

CVE-2026-82310: Insufficient Session Expiration

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-84397: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-93872

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-11984: Missing Authorization

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

Linux Distros Unpatched Vulnerability : CVE-2026-91841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline...