User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as ::ffff:10.0.0.0/8 compiles with all-zero leading bits and matches every address rather than the intended block. An attack...

CVE-2026-75983

The Eventin WordPress plugin (≤ 4.1.23 ) contains a privilege escalation vulnerability in PermissionManager::manage_permissions(), which is hooked into WordPress's map_meta_cap filter and unconditionally returns an always-true primitive for user ID 1 without scoping to plugin-specific capabilitie...

EUVD-2026-78298

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the PermissionManager::managepermissions function being registered as a callback on WordPress core's...

[SECURITY] [DLA 4780-1] urwid security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4780-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 15, 2026 https://wiki.debian.org/LTS -...

CVE-2026-81303

CVE-2026-81303 affects hawtio-operator , a Kubernetes operator. The operator holds the routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks....

CVE-2026-91773

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

CVE-2026-90849

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

CVE-2026-90849 SourceCodester College Notes Gallery Management System login.php sql injection

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

CVE-2026-90849 SourceCodester College Notes Gallery Management System login.php sql injection

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

CVE-2026-90849

CVE-2026-90849 affects SourceCodester College Notes Gallery Management System 1.0 . The vulnerability is a SQL injection in the file /College/login.php, triggered by manipulation of the User argument. The attack vector is remote with no authentication required and low complexity . Per the CVSS 3....

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

Chromium CVE-2026-87445: UI misrepresentation in Session

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-92546

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware component: Client Bundle. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication...

PT-2026-92194

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

PT-2026-92192

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

PT-2026-92666

Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM component: eDetailing. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Life Sciences...

PT-2026-93100

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. The attack requires human interaction from a...

PT-2026-92021

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...

PT-2026-92659

Name of the Vulnerable Software and Affected Versions Oracle iStore versions 12.2.3 through 12.2.15 Description A flaw in the Shopping Cart component allows a low privileged attacker with network access via HTTP to compromise the system. The attack requires human interaction and can lead to...

PT-2026-92868

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Control version 12.2.1.4.0 Oracle Fusion Middleware Control version 14.1.2.0.0 Description A flaw in the Framework component allows a low privileged attacker with network access via HTTP to compromise the system...