CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal

opensslencrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silent...

CVE-2026-81680

openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files. An attacker with write access to the file header can delete recovery-slot fields and bypass authentication without re-encrypting the payload, silently removing recovery paths the ...

CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal

opensslencrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silent...

EUVD-2026-67036

opensslencrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silent...

CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...

CVE-2026-49114

A flaw was found in ONNX. The saveexternaldata function is vulnerable to symlink following and path traversal. A local attacker with write access to a directory where a victim serializes external data can exploit this by pre-planting a symlink. This allows the attacker to cause the victim's write...

CVE-2026-81668 Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

EUVD-2026-67003

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

WordPress FoodBoxBooker plugin < 1.0.8 - Subscriber+ Arbitrary User Profile Update vulnerability

Subscriber+ Arbitrary User Profile Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin FoodBoxBooker versions 1.0.8...

CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM Tivoli System Automation Application Manager. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check ...

WordPress Dokan plugin < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability

Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability discovered by Shivamani Vastrala in WordPress Plugin Dokan versions 5.0.9...

WordPress Dokan plugin < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API vulnerability

Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Dokan versions 5.0.9...

WordPress Mobile App for WooCommerce plugin <= 0.4.69 - Other Vulnerability Type vulnerability

Other Vulnerability Type vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.69...

CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

EUVD-2026-66775

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary...

PT-2026-82422

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-74820: Improper Neutralization of Special Elements used in an SQL Command

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

The vulnerability of the Imperative Web Server component in the Oracle Helidon library of the Oracle Fusion Middleware software platform allows a perpetrator to gain access to add, delete, and modify data.

The vulnerability of the Imperative Web Server component of the Oracle Fusion Middleware library set is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain access to add, delete, and modify data...

The vulnerability in the `GitConfigParser._read()` function of the `git/config.py` module in the Python library for interacting with Git repositories in GitPython allows a attacker to execute arbitrary code.

The vulnerability of the GitConfigParser.read function in the git/config.py module of the Python library for interacting with Git repositories in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitra...