BELL-CVE-2026-35238 CVE-2026-35238 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35239 CVE-2026-35239 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34276 CVE-2026-34276 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34293 CVE-2026-34293 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35240 CVE-2026-35240 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34308 CVE-2026-34308 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35236 CVE-2026-35236 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34304 CVE-2026-34304 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35237 CVE-2026-35237 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22005 CVE-2026-22005 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22001 CVE-2026-22001 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34267 CVE-2026-34267 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22017 CVE-2026-22017 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22004 CVE-2026-22004 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22002 CVE-2026-22002 does not affect BellSoft software

Bulletin has no description...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the PageRules::create process in the page rules component. An attacker can publish a page without the required status-change permission by creating it as a non-draft. This lets a user who is allowed to create...

EUVD-2026-25391

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...

CVE-2026-33318 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user including BASIC role can escalate to ADMIN on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: POST /account/change-password has no authorization check, allowin...

EUVD-2026-25345

OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable IPv6 addresses to bypass SSRF protections...

PT-2026-34876

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.2.1 Description The authenticated '/ui/dags' endpoint fails to enforce per-DAG access control on embedded Human-in-the-Loop HITL and TaskInstance records. This allows a logged-in user with read access to at least on...