CVE-2026-75168: Improper Access Control

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

CVE-2026-75168

The MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) is vulnerable to an issue in the ugw-editfile method of the /cgi-bin/wwwugw.cgi component. This flaw allows a remote authenticated user with a low-privileged Standard role to write arbitrary content to files located within the /uxx/config/ an...

CVE-2026-85588: Exposure of Sensitive Information to an Unauthorized Actor

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

PT-2026-85548

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...

Linux Distros Unpatched Vulnerability : CVE-2026-76060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitiz...

PT-2026-85635

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFC NCI handlers where nci rf discover ntf packet and nci rf intf activated ntf packet parse notifications into uninitialized on-stack structures nci rf discover n...

PT-2026-85784

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue exists in the bpf component where the copy user syms function uses get user on a user space pointer without a preceding access ok call. This missing check fails to verify if th...

PT-2026-85373

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that woul...

CVE-2026-14350: Improper Output Neutralization for Logs

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-85604: Improper Control of Generation of Code

Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...

PT-2026-85521

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert user is admin if user query param is provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes imprope...

CVE-2026-75167

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

PT-2026-86230

Name of the Vulnerable Software and Affected Versions PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 Description A privilege escalation issue exists in the DirectIo64.sys driver. Local users can...

CVE-2026-75163: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...

CVE-2026-75164

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

CVE-2026-78658: Improper Removal of Sensitive Information Before Storage or Transfer

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an formation disclosure vulnerability when processing...

PT-2026-86224

Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM On-Prem Management interface affected versions not specified Description A missing authorization issue in the management interface allows a user with Admin privileges to escalate their permissions to...

EUVD-2026-71450

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

CVE-2026-16180: Improper Restriction of Recursive Entity References in DTDs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities...

PT-2026-86916

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9-2026-aug Magento Open Source versions 2.4.4 through 2.4.9-2026-aug Adobe Commerce B2B versions 1.3.3 through 1.5.3-2026-aug Description Adobe Commerce, Magento Open Source, and Adobe Commerce B2B are...