CVE-2026-116638

The Windows Recovery Environment WinRE in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to...

DeepSeek Harness permission and access control issue vulnerability

DeepSeek Harness versions 0.1.0-rc.5 and earlier contain a vulnerability related to permission escalation and access control. This issue stems from an operation within the createContext function in the file packages/extensions/cordis-host-runner/src/sandbox.ts, which leads to sandbox issues and m...

PT-2026-123194

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in missing authentication. The attack is only possible with local...

JIZHICMS permission and access control issues vulnerability

Versions JIZHICMS 2.5.6 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ‘orderno’ parameter within the Pay function of the file app/home/c/OrderController.php in the Front-end Order Handler component. It may lead to unauthorized access, and...

vLLM configuration error vulnerability

Versions of vLLM prior to 0.32.0 contain a configuration error vulnerability. This vulnerability arises because OpenAI-compatible servers by default set allowedorigins for Starlette CORSMiddleware to a wildcard value. As a result, malicious web pages can exploit this flaw, allowing victims’...

Webasyst Framework cross-site request forgery vulnerability

Webasyst Framework versions 4.4.0 and earlier contain a cross-site request forgery vulnerability. This flaw arises because the Photos application fails to enable CSRF checks within the framework; it is thus susceptible to such attacks. Attackers can trick logged-in Photos users into visiting...

PT-2026-123362

boneIO Black does not limit authentication attempts on its web interface POST /api/login or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized acce...

Daniel Gatis Rembg path traversal vulnerability

Versions of Daniel Gatis Rembg prior to 2.0.82 contain a path traversal vulnerability. This vulnerability arises because the publicly accessible /api/remove endpoint passes an attacker-controlled extras.sammodel parameter to both the SAM filename and the GitHub download URL without validating its...

WordPress LearnPress authorization issue vulnerability

WordPress LearnPress versions 4.4.11 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks, which may allow attackers to exploit improperly configured access control levels...

WordPress Discussion Board authorization issue vulnerability

WordPress Discussion Board versions 2.6.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

Apple MacOS: CVE-2026-112647: OS X update for iCloud

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data...

ROS-20261026-73-0173

The vulnerability in openssh is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

RHEL 9 : webkit2gtk3 (RHSA-2026:89821)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89821 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

PT-2026-123361

boneIO black debian images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write acces...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, and Apple macOS Golden Gate versions prior to 27.2. This vulnerability stems from improper input validation and may allow applications to access sensitive user data...

PT-2026-123253

Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2...

PT-2026-123164

Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution...

PT-2026-123200

Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10...

PT-2026-123284

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.120 before 6.4.122...

PT-2026-123262

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7...