CVE-2026-28188: Missing Authorization

Unauthenticated Broken Access Control in Hydra Booking = 1.2.2 versions...

CVE-2026-16871: Out-of-bounds Write

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow...

CVE-2026-58420: Improper Access Control

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-24059: Improper Privilege Management

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2025-62318: Cross-Site Request Forgery (CSRF)

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

CVE-2025-62314: Improper Restriction of Excessive Authentication Attempts

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

CVE-2026-66655: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2026-28142: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-58416: Improper Handling of Insufficient Permissions or Privileges

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58428: Improper Protection of Alternate Path

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-19694: Heap-based Buffer Overflow

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service...

CVE-2026-28156: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-24791: Incorrect Authorization

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-66443: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-27543: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-73499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a...

Linux Distros Unpatched Vulnerability : CVE-2026-14681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS...

RHEL 10 : freerdp (RHSA-2026:54667)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54667 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP...

CVE-2026-73401: Missing Authorization

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-59506: Missing Authentication for Critical Function

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...