PT-2026-123406

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, and Apple visionOS versions pri...

UBUNTU-CVE-2026-116096

A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function listpocketttsstateslots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, and Apple visionOS versions prior to 27.2. This vulnerability stems from improper access control and may allow applications to access sensitive...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from improper handling of symbolic links and may allow applications to access user-sensitive da...

PT-2026-123272

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5...

PT-2026-123315

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

boneIO black_debian_images trust management issue vulnerability

In boneIO blackdebianimages versions 1.2.0 through 1.6.0, there is a trust management vulnerability. This arises because the Mosquitto MQTT agent on all devices uses the same default credentials, and no changes are indicated in the documentation. Remote attackers can exploit this to gain full...

Apple MacOS: CVE-2026-86984: OS X update for Siri

A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access information about a user's contacts...

CreditNirvana Collections Platform authorization issue vulnerability

Versions prior to 4.8.2 of the CreditNirvana Collections Platform contain an authorization issue vulnerability. This vulnerability stems from improper authentication and authorization controls within the platform’s login service. Unauthenticated remote attackers can manipulate authentication...

WordPress Amelia authorization issue vulnerability

WordPress Amelia versions 2.4.10 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

boneIO Black authorization issue vulnerability

Versions 1.2.0 through 1.6.0 of boneIO Black contain an authorization issue vulnerability. This vulnerability stems from the Web interface POST /api/login and the SSH service failing to limit the number of authentication attempts or enforce strict password complexity rules. As a result,...

Prefetch Component Protected Information Access

The Prefetch component vulnerability in Google Chrome and Microsoft Edge web browsers is related to a flaw in the source verification mechanism. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Blink Component Protected Information Access

The Blink component vulnerability in Google Chrome and Microsoft Edge web browsers is related to a flaw in the source verification mechanism. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

MediaRecording Component Protected Information Access

The vulnerability in the MediaRecording component of Google Chrome and Microsoft Edge web browsers is related to improper protection against attacks via external physical channels. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information by using a...

Favicon Component Protected Information Access

The Favicon component vulnerability in Google Chrome and Microsoft Edge web browsers is related to improper protection against attacks via external physical channels. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information by using a specially crafte...

FedCM Component XSS

The vulnerability in the FedCM web browser components for Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected data, as well as trigger a...

Codecs Component Protected Information Access

The vulnerability in the Codecs component of Google Chrome and Microsoft Edge web browsers is related to the use of an uninitialized resource. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Codecs Component Protected Information Access

The vulnerability in the Codecs component of Google Chrome and Microsoft Edge web browsers is related to errors in variable initialization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

CrashReporting Component Protected Information Access

The vulnerability in the CrashReporting component of Google Chrome and Microsoft Edge web browsers involves reading protected information beyond its permitted buffer boundaries. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially...