PT-2026-89779

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-11446: Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

PT-2026-90059

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the sysctl implementation where the cad pid entry is incorrectly placed in the pid table instead of the kern reboot table. Because of the pid table root permissions...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper sanitization of .. in the Remote process. An attacker can manipulate file paths to escape the intended backend confinement by supplying specially crafted object names containing directory traversal...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper sanitization of .. in the Remote process. An attacker can manipulate file paths to escape the intended backend confinement by supplying specially crafted object names containing directory traversal...

CVE-2026-18994

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

EUVD-2026-75726

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

CVE-2026-88891

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion,...

CVE-2026-85217

A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy...

CVE-2026-85217 Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop

A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy...

CVE-2026-88891

OpenPanel fails to enforce its read-only project access level on 26 of 29 mutating procedures , caused by missing access level validation in mutation resolvers. Attackers with explicit read-only access can modify, delete, and publish project data , including deleting reports and dashboards, sched...

CVE-2026-88891 OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion,...

CVE-2026-88891 OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion,...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

Malicious code in fantastic_meadowlark_z3n (npm)

Source: amazon-inspector 5d4cf2548a07f093d4ad5a67bd98045036f5fea0539815d20b45892eb3c65cf3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in fantastic_rat_0xrequest (npm)

Source: amazon-inspector 672d1150557d92d01073a652a58e7812a0ab01fc933513767309a929f32eb102 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in fantastic_bug_z3n (npm)

Source: amazon-inspector f328417b6a7d59bae2188fc72c402b70aaa916f2cdd7970c66cc2650f66a67e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in fantastic_hedgehog_z3n (npm)

Source: amazon-inspector 2dcf6f2e3f5d9707c809e571d751f3cddf1f69332c78aeb8502260a29f1edd96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in fancy_wombat_z3n (npm)

Source: amazon-inspector 3f536bf172cd5d6137dca74cabae182965845233fafe707cc7c7cb96dd94bdd5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in fantastic_mollusk_z3n (npm)

Source: amazon-inspector 745781311c3184c105b6084a58a1ceb5994dd0fd2f737ec0f86affb100b831c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...