PT-2026-70346

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An Improper Encoding or Escaping of Output issue allows a low-privileged attacker to bypass security features. This can lead to limited unauthorized write acces...

PT-2026-70782

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description Improper input validation allows an attacker to bypass security features and obtain unauthorized limited write access. This issue can be exploited without any user interaction...

CVE-2026-48436: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...

PT-2026-70813

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Adobe Commerce B2B affected versions not specified Description An incorrect authorization issue exists in the authorization mechanism. An attack...

CVE-2026-48411: Incorrect Authorization

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require use...

CVE-2026-73219: Improper Validation of Consistency within Input

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

PT-2026-70376

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An improper input validation issue allows for a security feature bypass. An attacker can exploit this to gain unauthorized write access. This requires user interaction, such a...

PT-2026-70837

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue exists in the handling of certain query predicates against time-series collections that utilize a metaField. This flaw allows an authenticated user with write access to trigge...

CVE-2026-71390: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user...

PT-2026-70834

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

CVE-2026-67568: Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-21273: Improper Input Validation

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious...

CVE-2026-48437: Improper Certificate Validation

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interactio...

CVE-2026-34635: Use of Hard-coded Cryptographic Key

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user...

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

SummaryA user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

PYSEC-2026-3638 Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

SummaryOn standard channels, the message update and delete handlers accepted any caller holding write access on the channel, without checking that the caller wrote the message. Write access is the same grant a member needs in order to post, so every ordinary participant in a shared channel could...

PYSEC-2026-3649 Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Summary On standard channels, the message update and delete handlers accepted any caller holding write access on the channel, without checking that the caller wrote the message. Write access is the same grant a member needs in order to post, so every ordinary participant in a shared channel could...

PT-2026-69377

Name of the Vulnerable Software and Affected Versions Block User Account versions prior to 2.0.1 Description The plugin fails to enforce account blocks across all authentication paths. This allows a blocked user who possesses an application password created before the block was applied to maintai...

CVE-2026-18960: Improper Authentication

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...