Drupal REST & JSON API Authentication for Drupal authorization issue vulnerability

The Drupal REST & JSON API authentication issue affects Drupal versions from 0.0.0 up to and including version 3.2.0. This vulnerability arises because authentication can be bypassed via alternate paths or channels, potentially leading to unauthorized access...

WordPress PowerPack Addons for Elementor authorization issue vulnerability

WordPress PowerPack Addons for Elementor versions 3.1.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

Zenorzz Goploy authorization issue vulnerability

Zenorzz Goploy versions 4.0.0-beta.1 and earlier contain an authorization issue vulnerability. This vulnerability arises from authorization bypass via user-controlled keys, which can be exploited due to improperly configured access control security levels...

Knime Business Hub permission and access control issue vulnerability

Versions of KNIME Business Hub prior to 1.19.0 contain a permission and access control vulnerability. This vulnerability arises because network access between execution contexts is unrestricted. Authenticated remote users can access open network ports on executors within different execution...

WordPress MetForm authorization issue vulnerability

WordPress MetForm versions 4.3.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control levels...

Berri AI LiteLLM permission and access control vulnerability

A security vulnerability exists in Berri AI LiteLLM versions from 1.87.0 up to and including 1.100.4, from 1.101.0 up to and including 1.101.3, from 1.102.0 up to and including 1.102.2, from 1.103.0 up to and including 1.103.1, and from 1.104.0-rc.1 up to and including 1.104.0-rc.2. This...

Ahmad Majestic Support authorization issue vulnerability

Ahmad Majestic Support versions 1.2.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control security levels...

WordPress MarketKing authorization issue vulnerability

WordPress MarketKing versions 2.1.72 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks and improper configuration of access control security levels, potentially allowing attackers to exploit misconfigured access controls...

Grav permission and access control issues vulnerability

Versions of Grav from 3.6.0 up to and including 3.9.13 contain a permission and access control vulnerability. This flaw arises because the login.invite task lacks proper authorization checks. As a result, page authors can define invitation forms granting superuser privileges within the frontmatte...

PHPOffice PhpSpreadsheet input validation error vulnerability

A security vulnerability exists in PHPOffice PhpSpreadsheet versions prior to 3.10.8 and 4.0.0 up to 5.10.0. This vulnerability stems from improper entity decoding of SpreadsheetML XML by Reader\Xml. The double-encoded “” becomes a literal “” after two callbacks, allowing SimpleXML to receive...

WordPress eRoom authorization issue vulnerability

WordPress eRoom versions 1.7.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

USN-8930-2 u-boot vulnerabilities

USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could...

php: php: Access control bypass via partial IPv6 address comparison

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

Trigger.dev: Unauthenticated Realtime Stream Data Injection Via Run FriendlyId

Summary The POST handler for "/realtime/v1/streams/:runId/:streamId" has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: "apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts" The "actio...

CVE-2026-91487

A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces APIs, such as through a web service. Successful exploitation could allow the attacker to read, update, or...

CVE-2026-111835

Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8...

CVE-2026-91415

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces APIs, such as through a web service or application that processes graphics data. A successful attack...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2026-50010, CVE-2026-44249, CVE-2026-45416)

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-50010 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,...

EUVD-2026-107308

Improper link resolution before file access 'link following' vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2...

CVE-2026-114370

A flaw exists in the PathResourceManager component of the Undertow web server , which handles serving static files. The vulnerability stems from an inadequate verification mechanism for symbolic links; the system checks if a target path starts with an authorized string but fails to ensure it matc...