PT-2026-82064

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...

PT-2026-82221

Name of the Vulnerable Software and Affected Versions Automatisch affected versions not specified Description An information disclosure issue exists in the forgot-password functionality. The endpoint '/api/v1/users/forgot-password' allows an unauthenticated user to determine if a specific address...

CVE-2026-79654: Authorization Bypass Through User-Controlled Key

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

PT-2026-82282

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/username/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the...

PT-2026-82334

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.1 Description Cluster-scoped APIs do not consistently validate per-cluster access. This allows an authenticated user with cluster management permissions to operate on clusters outside their granted scope. Because t...

CVE-2026-63360: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-77801: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

PT-2026-82077

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.18 Description The getgrav/grav-plugin-api plugin fails to enforce API-key scope within the requireNotSuperTarget function located in UsersController.php across seven sensitive user-management...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098940)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098940 advisory. In the Linux kernel, the following vulnerability has been resolved: slip: reject VJ receive packets on instances with no rstate array slhcinit accepts rslots == 0 a...

Linux Distros Unpatched Vulnerability : CVE-2026-79619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host...

PT-2026-82359

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description An authenticated user with the role:reader role on any project can list all project-scoped role assignments under any domain. This occurs when a domain ID is passed as scope.project.id wi...

PT-2026-82094

Name of the Vulnerable Software and Affected Versions OpenZFS affected versions not specified Description On Linux, several ioctl authorization checks incorrectly treat capabilities held within a user-created, unprivileged namespace as equivalent to actual host privileges. This allows an...

CVE-2025-61162: Improper Access Control

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

PT-2026-82236

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USER ID endpoint...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2026-79619: Incorrect Authorization

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrativ...

PT-2026-82370

Name of the Vulnerable Software and Affected Versions Drupal Address Suggestion versions 0.0.0 through 1.0.25 Description Improper neutralization of input during web page generation allows for Cross-Site Scripting XSS. The Address Suggestion module, which provides address autocomplete functionali...

CVE-2026-15387: Acceptance of Extraneous Untrusted Data With Trusted Data

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy...