CVE-2026-74769

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass...

httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

...

CVE-2026-85237: Improper Restriction of Excessive Authentication Attempts

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

CVE-2026-74769: Incorrect Authorization

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105423)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105423 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sched: cake: fix null pointer access issue when cakeinit fails When the default qdisc is cak...

PT-2026-84923

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass...

The vulnerability of the tcf_ct_skb_nfct_cached() function in the net/sched/act_ct.c module of the network scheduling subsystem of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the tcfctskbnfctcached function in the net/sched/actct.c module of the net/sched subsystem of the Linux operating system’s kernel is related to insufficient protection of service data. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of Windows Event Logging, a service in the Windows operating system, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Windows Event Logging service is related to the improper saving of generated signatures due to a violation of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Security Bulletin: Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access Vulnerability Details CVEID:CVE-2026-11927 DESCRIPTION: IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-20277

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-12704

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...

CVE-2026-20277

Cisco IOS XR Software is affected by multiple internally discovered protection mechanism failure vulnerabilities (CWE-693), identified during a comprehensive internal security review. The issues carry a CVSS v3.1 score of 8.2 (HIGH) , with primarily an availability impact and a low integrity impa...

CVE-2026-20277 Cisco IOS XR Software Security Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

EUVD-2026-70202

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-20277 Cisco IOS XR Software Security Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-78153

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

CVE-2025-15490

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

CVE-2025-8945

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-15490 Passster < 4.2.26 - Global Protection Bypass

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

CVE-2025-8945 Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...