CVE-2026-14212 Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

CVE-2026-14212 Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

RLSA-2026:22112 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...

PT-2026-82236

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USER ID endpoint...

CVE-2026-77611: Incorrect Authorization

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler...

PT-2026-81945

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions 9.0 through 9.7 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. This allows an authenticated attacker with Provider-level...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2025-61162

Cohere North AI v1.1.5 is affected by an incorrect access control vulnerability. A remote attacker can send a specially crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint to arbitrarily overwrite user information , leading to unauthorized modification of user data. To mitigate thi...

PT-2026-82155

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the amdgpu cs pass1 function fails to reject repeated chunk IDs. When a submission contains multiple AMDGPU CHUNK ID FENCE chunks, the...

CVE-2025-61162: Improper Access Control

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: f2fs-tools (UTSA-2026-093563)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093563 advisory. An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause...

PT-2026-82050

Arbitrary file overwrite via SAVE PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

CVE-2026-59682: External Control of File Name or Path

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

Unity Linux 20.1060a / 20.1070a Security Update: abrt (UTSA-2026-104842)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104842 advisory. A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098704)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098704 advisory. In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/riocm.c: prevent possible heap overwrite In riocmcdevioctlRIOCMCHANSEND -...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng12 (UTSA-2026-093152)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093152 advisory. Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the pngrgbtogr...

RockyLinux 10 : golang (RLSA-2026:22120)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22120 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

RockyLinux 8 : go-toolset:rhel8 (RLSA-2026:22112)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22112 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...