CVE-2026-66412

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

PT-2026-64947

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

PT-2026-65327

Name of the Vulnerable Software and Affected Versions Xendit Payment versions prior to 7.1.1 Description Broken Access Control allows unauthenticated users to bypass authorization restrictions within the plugin. Recommendations Update Xendit Payment to a version newer than 7.1.0...

PT-2026-64896

An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...

PT-2026-65323

Name of the Vulnerable Software and Affected Versions Ad Invalid Click Protector AICP versions prior to 1.3.1 Description Broken Access Control allows unauthenticated users to bypass security restrictions within the plugin. Recommendations Update Ad Invalid Click Protector AICP to a version newer...

PT-2026-64925

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

PT-2026-64852

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.6.3 Description Authenticated users can access milestone data from projects to which they are not assigned. This is possible by providing arbitrary integer milestone IDs to the 'tickets.getMilestone' JSON-RPC...

EUVD-2026-49046

A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improp...

SUSE CVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

EUVD-2026-49045

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-64395

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

CVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

EUVD-2026-48938

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

CVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

CVE-2026-64388

Summary: CVE-2026-64388 affects the Linux kernel SMB client when using SMB3 POSIX Extensions, where chown/chgrp updates could be ignored unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID are also set. The root cause is a missing check for posix_extensions in cifs_setattr_nounix() during UID/...

EUVD-2026-48932

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

CVE-2026-64379 smb: client: mask server-provided mode to 07777 in modefromsid

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...