EUVD-2026-66265

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of...

CVE-2026-80191

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...

CVE-2026-29988

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...

Linux Distros Unpatched Vulnerability : CVE-2026-79776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can...

CVE-2026-26447

Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap...

VulnCheck KEV: CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093307)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093307 advisory. Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 an...

CVE-2026-26447

Stomper (commit 5e2741e ) contains a heap use-after-free vulnerability in its STOMP broker's subscription management. When a single client repeatedly sends SUBSCRIBE commands for the same destination and then disconnects, the broker incorrectly cleans up its internal subscription structures. The ...

CVE-2026-75325

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

PT-2026-81948

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

VulnCheck KEV: CVE-2026-49869

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath.endsWith"/configs" to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match...

CVE-2026-75329

super-diamond-server versions ≤ 1.3.3 have a missing authentication vulnerability in its Netty configuration distribution service (port 8283). An unauthenticated attacker can send a plain TCP request to obtain the full configuration of any project , including database passwords and API keys . The...

PT-2026-82369

Name of the Vulnerable Software and Affected Versions Drupal Digital Signage Framework versions 0.0.0 through 2.6.1 Description A missing authorization issue allows forceful browsing. The module provides a route for signage devices to refresh dynamic blocks on a display, but it fails to verify if...

CVE-2026-75413

DocSys V2.02.80 contains an Any File Download vulnerability in the downloadDocEx.do interface. An unauthenticated attacker can exploit the targetPath parameter to download arbitrary files over the network without any prior authentication. The CVSS 3.1 score is 7.5 (HIGH) , reflecting a network at...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093682)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093682 advisory. Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 an...

Linux Distros Unpatched Vulnerability : CVE-2026-75421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aria2 =1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine function. CVE-2026-75421 Note that Nessus relies on the presence of the package ...

conduit -- authentication bypass vulnerability

Conduit team reports: Fixes a vulnerability where endpoints which required authentication, but functionality do not depend on the user/server calling it, could have their authentication bypassed, as well as causing crashes for all other authenticated endpoints. It is recommended you upgrade ASAP...

CVE-2026-80191 GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...

CVE-2026-80191 GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...