CVE-2026-96380

The Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2 ) contains a Missing Authorization vulnerability. The root cause is that the module fails to sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions. This allows for Forceful Browsing , wh...

CVE-2026-96380 CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2...

CVE-2026-96380 CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2...

CVE-2026-96380 CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2...

CVE-2026-96386 Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1...

CVE-2026-96386 Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1...

CVE-2026-96386 Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1...

CVE-2026-96386

The Drupal Smart Content module (versions 0.0.0 to 3.2.1 ) is vulnerable to a Missing Authorization flaw leading to Forceful Browsing . The root cause is that the Smart Content Block submodule fails to sufficiently verify access permissions when rendering blocks through a "Display Blocks" reactio...

CVE-2026-14288

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

DEBIAN-CVE-2026-91395

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM...

DEBIAN-CVE-2026-91396

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM...

EUVD-2026-107644

In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer REST API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrati...

EUVD-2026-107641

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by...

EUVD-2026-107652

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by...

EUVD-2026-107657

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access. The vulnerability is possible because the...

EUVD-2026-107578

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and...

CLSA-2026-1792400260 Fix of 74 CVEs

CVE-2026-99999 - ipv4: validate checksumstart before completing checksum CVE-2026-99999 CVE-2026-64015 - security/keys: fix missed RCU read section on lookup CVE-2026-64015 CVE-2023-53282 - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write CVE-2023-53282 CVE-2026-43250 -...

ABB Ability Edgenius authorization issue vulnerability

ABB Ability Edgenius versions 3.2.3.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing unauthorized access to these functions...

PT-2026-121300

Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1...

PT-2026-121372

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch organization...