PT-2026-70029

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description The WebSocket component of SAP Approuter fails to perform sufficient authorization checks within certain functionality. This allows an attacker with low privileges to access restricted...

PT-2026-70239

Name of the Vulnerable Software and Affected Versions NETGEAR R7000 affected versions not specified Description Insufficient input validation allows authenticated administrators connected to the local network to make unauthorized modifications to the router software and functionality...

CVE-2026-11737: Improper Input Validation

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...

CVE-2026-72595: Improper Access Control

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

PT-2026-70854

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue allows an authenticated user with a limited database-scoped role to perform actions against protected system collections that normally require more specific privileges. This c...

CVE-2026-11735: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality...

PT-2026-70864

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in Queryable Encryption maintenance operations allows an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of da...

PT-2026-70935

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 2.0.0-rc6 Description Kestra serves Micronaut management endpoints on port 8081 without authentication, bypassing the Basic Auth protection applied to the /api/v1/ endpoints on port 8080. This allows unauthenticated...

CVE-2026-72546: Authorization Bypass Through User-Controlled Key

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-18698: Incorrect Authorization

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations,...

CVE-2026-18712: Incorrect Authorization

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

PT-2026-70940

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/library id/book id/fmt in src/calibre/srv/books.py omits needs db write=True, causing Router.dispatch to skip ctx.check for write access before update annotations passes...

CVE-2026-9214: Improper Input Validation

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

CVE-2026-11738: Improper Input Validation

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

CVE-2025-30238

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...

EUVD-2026-55832

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...

CVE-2026-72910 ERPNext: Unauthorised modification of master data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...

CVE-2026-72910 ERPNext: Unauthorised modification of master data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

CVE-2026-58041

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application. Mitigation Applicatio...