CVE-2026-71459: Missing Authorization

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

This module enables sites to block access for the administrative user account user 1 or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be abl...

GitLab 18.6 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92628)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared stat...

PT-2026-97479

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

CVE-2026-95602: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

PT-2026-97366

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An administrative user can obtain sensitive information when the browser returns a detailed technical error message. This exposure of internal data could be leveraged to facilitate further...

CVE-2026-81208: Insufficiently Protected Credentials

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

PT-2026-97677

This module enables sites to block access for the administrative user account user 1 or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be abl...

CVE-2026-95525: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

Foxit PDF Reader Portfolio Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

CVE-2026-85475: Improper Neutralization of Directives in Statically Saved Code

A flaw was found in the Ansible Automation Platform automation controller. The external logging rsyslog configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript conf...

CVE-2026-95523: Authentication Bypass by Spoofing

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-93510: Missing Authorization

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

CVE-2026-52744: Missing Authorization

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-86679: Improper Input Validation

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

CVE-2026-4921: Generation of Error Message Containing Sensitive Information

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2026-6730: Buffer Copy without Checking Size of Input

IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system...

Linux Distros Unpatched Vulnerability : CVE-2026-89780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub- frame with allocskb and leaves skb-dev NULL...

CVE-2026-90904: Improper Access Control

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...