CVE-2026-85104 Brain stimulation parameters can be modified via Bluetooth in Sooma

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

CVE-2026-8462

CVE-2026-8462 is a SQL injection in OpenMeter (versions before v1.0.0-beta.228 ) in the ClickHouse-backed meter definitions. The vulnerable code in openmeter/streaming/clickhouse/utils_query.go builds ClickHouse queries using fmt.Sprintf with sqlbuilder.Escape(), which fails to escape single quot...

CVE-2026-86341

CVE-2026-86341 affects GitLab EE versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The root cause is an improper access control check performed after a protected environment approval rule was already modified, rather than before. Under certain conditions, an authentica...

CVE-2026-86341 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

WordPress FluentBoards plugin < 2.0.15 - Board Member+ Board Membership and Public Access Modification vulnerability

Board Member+ Board Membership and Public Access Modification vulnerability discovered by vuxvinh in WordPress Plugin FluentBoards versions 2.0.15...

EUVD-2026-80184

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

CVE-2026-14349

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-14349 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-14349 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-80094

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-14349

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.3 . The root cause is a missing permission check on the admin_addcustomer AJAX action in main/function_ajax.php, allowing unauthenticated at...

SUSE CVE-2026-82049

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

CVE-2026-91100: Improper Neutralization of Special Elements used in an OS Command

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-61598: Improperly Controlled Modification of Dynamically-Determined Object Attributes

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

PT-2026-93268

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-93923

Name of the Vulnerable Software and Affected Versions HPLIP versions prior to 3.26.6-1.1 Description Multiple security issues within several software components could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file...

CVE-2026-20285: Improper Authorization

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

AlmaLinux 9 : firewalld (ALSA-2026:67585)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67585 advisory. firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis- authorization CVE-2026-4948 Tenable has extracted the preceding...

CVE-2026-92217: Improperly Controlled Modification of Dynamically-Determined Object Attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

CVE-2026-20247: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected...