CVE-2026-14971 This PowerVM Novalink update is being released to address

IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions...

CVE-2026-62235 Grav Flex-Objects < 1.4.3 Authorization Bypass via API

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

EUVD-2026-45081

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

CVE-2026-62231 Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator

The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...

CVE-2026-62217

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contains an authorization flaw in the QQBot exec approvals feature. When enabled and reachable, a lower-trust caller or configured input path could perform actions beyond the caller’s intended authorization, allowing non-allowlisted senders to execute or...

RabbitMQ 3.13.x < 3.13.15 / 4.0.x < 4.0.20 / 4.1.x < 4.1.11 / 4.2.x < 4.2.6 AMQP Authorization Bypass

The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks,...

PT-2026-60806

Name of the Vulnerable Software and Affected Versions Helm versions prior to 4.2.4 Description A denial of service issue exists in the Files.Lines template helper within pkg/engine/files.go. An attacker can trigger an index out of range panic by including zero-length byte slices in chart files...

CVE-2026-15449

CVE-2026-15449 describes a TOCTOU vulnerability in the illumos data-link pseudo-driver (dld) regarding handling of DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. In drv_ioc_prop_common(), the header is read once to obtain pr_valsize, a kernel heap buffer is allocated, and then the fu...

MAL-2026-10745 Malicious code in phantomx-tool-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e528800706b219f69d8bc87eb77203c752c8b4720e8c0b8fc04cad6df8ce1d When the tool-server bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers...

Malicious code in @yeaft/webchat-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b627f9a4ff0aaacfcd612224f76fe679e9d0a04578519d75516136e7496aad43 The package installs itself as a user-level service systemd on Linux via service/linux.js, with launchd/PM2 siblings and, at agent startup, opens a...

MAL-2026-10723 Malicious code in @yeaft/webchat-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b627f9a4ff0aaacfcd612224f76fe679e9d0a04578519d75516136e7496aad43 The package installs itself as a user-level service systemd on Linux via service/linux.js, with launchd/PM2 siblings and, at agent startup, opens a...

EUVD-2026-44950

Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such...

Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution

Laravel version 8.4.2 and before with Ignition before 2.5.2 allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2. id: CVE-2021-3129 info: name:...

CVE-2026-52892 Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST,...

EUVD-2026-44730

Pegatron Tdelo64.sys improperly exposes privileged hardware access functionality through the \.\TdeIo device interface. IOCTL handlers including TDEIOCTLINDEXIOREAD and TDEIOCTLINDEXIOWRITE permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without...

EUVD-2026-44754

BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting a...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

CVE-2026-60085

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blockedcommands, blockedpaths, blockedimports, allowsubprocess, and allowfilewrite restrictions are completely ignored. Attackers can execute arbitrary subprocess commands,...

CVE-2026-61866

CVE-2026-61866 affects ImageMagick before 7.1.2-26. A memory leak occurs in the JNG encoder when a blob cannot be opened, and attackers can trigger it by providing malformed JNG files that fail blob operations, causing resource exhaustion. No remediation details are provided in the supplied docum...

EUVD-2026-44615

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion...