298296 matches found
PT-2026-91473
Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 Description A privacy issue exists where sensitive data is stored in a manner that may allow an app to fingerprint the user. Fingerprinting is a technique used to uniquely identify a...
PT-2026-91486
Name of the Vulnerable Software and Affected Versions macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 Description A race condition occurs due to insufficient locking, which may allow a local user to read kernel memory. A race conditio...
PT-2026-91541
Name of the Vulnerable Software and Affected Versions macOS versions prior to Golden Gate 27 Description An issue in the handling of snapshots could allow an application to access protected user data. This was caused by a flaw in the permissions logic. Recommendations Update to macOS Golden Gate ...
PT-2026-91547
Name of the Vulnerable Software and Affected Versions Xcode versions prior to 27 macOS Golden Gate versions prior to 27 Description A permissions issue exists where improved validation was required to prevent unauthorized access. This flaw could allow an application to access user-sensitive data...
PT-2026-91516
A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to identify what other apps a user has installed...
PT-2026-91840
Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects shared between different organizations, potentially allowing users to ke...
CVE-2026-84615: Improper Authorization
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, tvOS 27, visionOS 27. An app may be able to access sensitive user data...
CVE-2026-84603: Improper Privilege Management
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data...
CVE-2026-65353: Improper Authorization
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An app may be able to access sensitive user data...
CVE-2026-19816: Incorrect Authorization
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...
CVE-2026-59570: Improper Input Validation
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
CVE-2026-90933: Missing Authorization
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...
CVE-2026-90931: Improper Neutralization of Input During Web Page Generation
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...
PT-2026-91399
Name of the Vulnerable Software and Affected Versions Temporary Elevated Access Management TEAM for AWS IAM Identity Center versions prior to 1.5.1 Description An incorrect privilege assignment exists that may allow an authenticated remote user with application-level access to read, approve,...
CVE-2026-4103: Improper Neutralization of Input During Web Page Generation
Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...
CVE-2026-7884: Improper Neutralization of Input During Web Page Generation
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...
PT-2026-91154
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...
PT-2026-91732
Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 Description A non-privileged user can inject malicious JavaScript code by editing their given name and surname. The code executes...
CVE-2026-54178: Improper Limitation of a Pathname to a Restricted Directory
backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts...
CVE-2026-54447: Incorrect Permission Assignment for Critical Resource
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...