CVE-2026-40737: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects COMPE: from n/a through = 1.1.4...

CVE-2025-67841: Inefficient Algorithmic Complexity

Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue...

CVE-2026-5387: Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer Administrator roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, an...

CVE-2026-40778: Missing Authorization

Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through = 1.1.2...

CVE-2025-52641: Generation of Error Message Containing Sensitive Information

HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information...

PT-2026-33185

The Barcode Scanner +Mobile App – Inventory manager, Order fulfillment system, POS Point of Sale plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied...

CVE-2026-21726: Improper Limitation of a Pathname to a Restricted Directory

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/namespace Thanks to Prasanth Sundararajan for reporting this vulnerability...

CVE-2025-40897: Incorrect Authorization

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform...

CVE-2024-53412: Improper Neutralization of Special Elements used in a Command

Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field...

Vulnerable-Web-App-Scanner

Vulnerable-Web-App-Scanner Pent...

CVE-2026-33825: Insufficient Granularity of Access Control

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally...

CVE-2026-32220: Improper Access Control

Improper access control in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to bypass a security feature locally...

CVE-2026-32196: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-26169: Buffer Over-read

Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally...

CVE-2026-26155: Buffer Over-read

Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability...

CVE-2026-2401: Insertion of Sensitive Information into Log File

CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious file provided by an attacker...

CVE-2026-27909: Use After Free

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-2399: Improper Limitation of a Pathname to a Restricted Directory

CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause critical files overwritten with text data when a Web Admin user alters the POST /REST/upssleep request payload...

CVE-2026-2400: Improper Neutralization of CRLF Sequences

CWE-93 Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability exists that could cause application user credentials to reset when a Web Admin user alters the POST /setPCBEDesc request payload...

CVE-2026-2403: Improper Validation of Specified Quantity in Input

CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload...