CVE-2026-12995: Authorization Bypass Through User-Controlled Key

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2026-18172: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

SUSE CVE-2026-68586

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints gated only by...

SUSE CVE-2026-90298

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: tcon: Drop TCON TOP device reference offinddevicebynode takes a device reference. Drop it after mux configuration succeeds...

io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

CVE-2026-94382

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to...

CVE-2026-94394

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

EUVD-2026-83912

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

CVE-2026-94382 Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to...

CVE-2026-91867

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread denial of service. Users are recommended to upgrade to version 3.2.4, which fixes thi...

CVE-2026-73513: Improper Input Validation

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...

CVE-2026-94382: Authorization Bypass Through User-Controlled Key

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to...

CVE-2026-91867: Uncontrolled Resource Consumption

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread denial of service. Users are recommended to upgrade to version 3.2.4, which fixes thi...

PT-2026-96084

Name of the Vulnerable Software and Affected Versions Neethi versions prior to 3.2.4 Description An issue exists when fetching a remote policy reference where the system only limits the time per read rather than the entire transfer. A malicious server can send bytes slowly to keep the fetch...

PT-2026-96093

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description An insecure direct object reference exists in the processModuleResultsData function of the Event model. When processing module results, the system fails to unset the client-supplied id field for...

Linux Distros Unpatched Vulnerability : CVE-2026-93564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted...

ROS-20260921-73-0068

The vulnerability in the kernel-lt is related to the use of a name with an incorrect reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

NPM vm2 Code Execution

The vulnerability of the NPM package manager’s vm2 library is related to the use of a name with an incorrect reference. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SUSE CVE-2026-89934

In the Linux kernel, the following vulnerability has been resolved: iio: light: ltrf216a: fix runtime PM reference leak in error path ltrf216agetlux acquires a runtime PM reference by calling ltrf216asetpowerstatedata, true. However, if ltrf216areaddata fails, the function returns immediately...