CVE-2026-82754: Improper Protection of Alternate Path

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

ROS-20260907-73-0083

The vulnerability of the Microsoft .NET software platform and the Microsoft Visual Studio development tools is related to a breach of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

ROS-20260907-73-0085

The vulnerability of the Microsoft .NET software platform and the Microsoft Visual Studio development tools is related to a breach of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

CVE-2026-82586: Improper Protection of Alternate Path

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

CVE-2026-80170: Use of Hard-coded Credentials

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypa...

PT-2026-86781

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to...

ROS-20260907-73-0087

The vulnerability of the Microsoft .NET software platform and the Microsoft Visual Studio development tools is related to a breach of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

CVE-2026-80238: Execution with Unnecessary Privileges

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechani...

PT-2026-86829

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypa...

The vulnerability of the IBM Sterling B2B Integrator and IBM Sterling File Gateway software solutions lies in their lack of protection for website structures. This allows attackers to execute arbitrary JavaScript code and disclose sensitive information.

The vulnerability of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file gateway software lies in the lack of security measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code and...

The vulnerability of the user remote access agent for corporate resources and Prisma Access applications lies in the violation of data protection mechanisms, allowing attackers to bypass unauthorized access protections.

The vulnerability of the Prisma Access Agent, a user-level remote access agent for corporate resources and applications, is related to a flaw in the data protection mechanism. Exploiting this vulnerability could allow an attacker to circumvent security measures against unauthorized access...

The vulnerability of SIPROTEC 5 devices, which are designed for relay protection, automation, and control, lies in their ability to load files of a harmful nature without limitation. This allows attackers to execute arbitrary codes or trigger malfunctions in the equipment.

The vulnerability of SIPROTEC 5 devices for relay protection, automation, and control is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause service failures...

The vulnerability of the configuration file 4_testintegration_fim-tier-0-1-win.yml on the Wazuh security monitoring and threat detection platform allows a perpetrator to gain access to and modify this data.

The vulnerability of the configuration file 4testintegrationfim-tier-0-1-win.yml of the security monitoring and threat detection platform Wazuh is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to gain read access and modify data...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053252)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053252 advisory. In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I'v...

CVE-2026-86186

AVideo is a video hosting platform whose API rate-limiting mechanism fails to account for requests carrying a bot User-Agent header . This allows an unauthenticated attacker to bypass all eight protected operations , including login brute-force protection , by simply setting a bot User-Agent stri...

CVE-2026-86186: Improper Restriction of Excessive Authentication Attempts

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-77830: Improper Neutralization of Input During Web Page Generation

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage.

The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a...

AZL-99569 CVE-2026-80851 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTPCMDDELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU...

CVE-2026-80851 gtp: serialize PDP context updates

In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTPCMDDELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU...