EUVD-2026-81394

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to...

CVE-2026-50605 Privilege Escalation Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to...

CVE-2026-50605

CVE-2026-50605 affects the Acer Agent Service component bundled with NitroSense and PredatorSense software. The root cause is insufficient access controls within a privileged service, allowing an authenticated local user to perform unauthorized registry operations, which may lead to privilege esc...

CVE-2026-54670: Improper Limitation of a Pathname to a Restricted Directory

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

PT-2026-94575

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme/ioctl component where the NVME IOCTL SUBMIT IO endpoint does not utilize the nvme cmd allowed function. This allows unprivileged users to perform I/O operatio...

PT-2026-94188

Name of the Vulnerable Software and Affected Versions NitroSense affected versions not specified PredatorSense affected versions not specified Description Insufficient access controls within the Acer Agent Service component may allow an authenticated local user to perform unauthorized registry...

PT-2026-94199

Name of the Vulnerable Software and Affected Versions NitroSense affected versions not specified PredatorSense affected versions not specified Description Insufficient access controls within a privileged Named Pipe service in the Acer System Monitoring component allow an authenticated local user ...

PT-2026-95077

Name of the Vulnerable Software and Affected Versions Obsidian Web MCP versions prior to 0.2.0 Description An authentication bypass exists where the '/oauth/authorize' endpoint issues an authorization code without requiring login, consent, or a session check. Subsequently, the '/oauth/token'...

CVE-2026-87976

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

CVE-2026-92466 microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including use...

PT-2026-93941

Name of the Vulnerable Software and Affected Versions Apache NiFi Registry versions 0.4.0 through 2.11.0 Description An issue exists during the storage of extension bundle content when using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provide...

CVE-2026-87159

Vulnerability in the Oracle HRMS India product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS India. Successf...

CVE-2026-87161

Vulnerability in the Oracle HRMS India product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS India. While th...

CVE-2026-87155

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

CVE-2026-87153

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

CVE-2026-87124

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Whil...

CVE-2026-87125

Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83490

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Whil...