PT-2026-71915

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to ...

PT-2026-71546

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

PT-2026-71563

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

Vulnerability in core server (CVE-2026-14666)

PostgreSQL row security caching disregards role modifications Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse...

PT-2026-71557

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-72585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required...

PT-2026-71518

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

PT-2026-71486

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan file parameter, leading to Remote Code Execution. Combined with open registration no invite...

PT-2026-71520

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

PT-2026-71586

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-72809

SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...

CVE-2026-72791

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

CVE-2025-9486

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

CVE-2026-72809

SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...

CVE-2026-72791

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

CVE-2025-9486 Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

CVE-2025-9486

CVE-2025-9486 affects GitLab EE, with versions 15.6 up to before 19.0.6, 19.1 up to before 19.1.4, and 19.2 up to before 19.2.2. The issue arises from an incorrect privilege assignment that did not account for a user’s pending membership state, potentially allowing a user to receive permissions g...

EUVD-2025-210720

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

CVE-2025-9486 Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

EUVD-2026-57441

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to...