CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: landlock: Fixed the bypass of LANDLOCKSCOPESIGNAL on the SIGIO path. LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. This bypass can occur through the asynchronous SIGIO...

PT-2026-81025

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client credentials grant, validate scopes against key/...

PT-2026-80852

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

PT-2026-81026

Name of the Vulnerable Software and Affected Versions hex.pm versions 2025-10-10 through 2026-08-23 Description An insufficient session expiration issue exists in the OAuth token refresh grant. The expand repositories scope/3 function in lib/hexpm/permissions.ex only rewrites the literal...

CVE-2026-76842: Improper Limitation of a Pathname to a Restricted Directory

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-75866

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

EUVD-2026-64293

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

CVE-2026-75866 Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

CVE-2026-75866 Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

CVE-2026-75866

The Punk::OAuth2::Server Perl module (versions through 0.03 ) contains a vulnerability where it issues access tokens outside a client's registered scopes and grant types. The root cause is that the authorization path fails to validate the requested scope against the client's registration. Specifi...

CVE-2026-75866: Missing Authorization

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

PT-2026-79570

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant types per client and documents both as client registration. token dispatche...

EUVD-2026-63994

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

OpenJDK: Enhance HTTP Connections (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

Oracle Primavera P6 Enterprise Project Portfolio Management (August 2026 CSPU)

The version of Primavera P6 Enterprise Project Portfolio Management installed on the remote host is affected by a vulnerability as referenced in the August 2026 CSPU advisory. - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineerin...

CVE-2026-67567

CVE-2026-67567 is a CRITICAL (CVSS 9.9) privilege escalation vulnerability in the multicloud-operators-subscription Kubernetes operator. The HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper GVK or namespace restriction , allowin...

OpenJDK: Enhance HTTP Connections (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause / addBaseClause e.g. tenant isolation, user ownership. However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An...

EUVD-2026-63484

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...