CVE-2026-116638

The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow attackers with physical or administrative access to bypass firmware security controls , including administrator-configured UEFI/BIOS passwords . The issue stems from inconsistent enforcement of security controls during recove...

PT-2026-123202

Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6...

PT-2026-123194

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in missing authentication. The attack is only possible with local...

PT-2026-123271

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5...

PT-2026-123257

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

ROS-20261026-73-0014

The vulnerability in openssh is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20261026-73-0203

The vulnerability in rabbitmq-server relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2026-123361

boneIO black debian images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write acces...

Apple Security Advisory 10-26-2026-5

Apple Security Advisory 10-26-2026-5 - macOS Tahoe 26.7.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, arbitrary code execution, and information disclosure vulnerabilities...

Apple Security Advisory 10-26-2026-7

Apple Security Advisory 10-26-2026-7 - tvOS 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, buffer overflow, integer overflow, and information disclosure vulnerabilities...

Billabear authorization issue vulnerability

Billabear versions 2025.01.03 and earlier contain an authorization issue vulnerability. This vulnerability stems from the absence of authentication in the processInstall function within the file src/BillaBear/Controller/InstallController.php in the Installation Handler component, potentially...

WordPress Bopo authorization issue vulnerability

WordPress Bopo versions 1.2.3 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

PT-2026-123362

boneIO Black does not limit authentication attempts on its web interface POST /api/login or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized acce...

PT-2026-123154

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb platform/core/openbb core/app/model/api settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Th...

Apple MacOS: CVE-2026-112647: OS X update for iCloud

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data...

Daniel Gatis Rembg path traversal vulnerability

Versions of Daniel Gatis Rembg prior to 2.0.82 contain a path traversal vulnerability. This vulnerability arises because the publicly accessible /api/remove endpoint passes an attacker-controlled extras.sammodel parameter to both the SAM filename and the GitHub download URL without validating its...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.10. It arises because btintelpciepreparetx uses tfdindex to access the TFD and data buffer array before incrementing the index based on modulo operation with txq-count. Boundary checks fail to reject out-of-bounds indices equal to txq-coun...

PT-2026-125326

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data...

WordPress LearnPress authorization issue vulnerability

WordPress LearnPress versions 4.4.11 and earlier contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks and may allow attackers to exploit improperly configured access control levels...

HeyCyan permission and access control issues vulnerability

The HeyCyan 1.0.103 version contains a vulnerability related to permission and access control issues. This flaw stems from improper access control in the FileProvider component, potentially allowing remote attackers to gain unauthorized access...