OpenReception Appointment authorization issue vulnerability

Versions prior to OpenReception Appointment 2.2.1 contain an authorization issue vulnerability. This vulnerability arises because pending invitation tokens can be reused. Attackers can obtain passkey registration credentials and register their own passkeys on the invited account, thereby gaining...

Node.js Node permissions and access control issues vulnerability

Node.js versions 22.23.3 and earlier, 24.22.0 and earlier, and 26.12.0 and earlier contain a permission and access control vulnerability. This vulnerability arises because hostnames containing NUL bytes during DNS resolution are silently truncated by the dns.resolve function and dns.reverse...

Red Hat: CVE-2026-106071: nodejs: nodejs: Permission model bypass via wildcard path matching flaw

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...

LangChain LangGraph input validation error vulnerability

A security vulnerability exists in LangChain LangGraph. It stems from improper validation of namespace tags; PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore concatenate namespace tags with “.”. In contrast, BaseStore only validates tags for put and aput operations. Unvalidate...

ROS-20261023-73-0018

The vulnerability in golang-github-prometheus is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

OpenReception Appointment authorization issue vulnerability

OpenReception Appointment versions 2.1.0 and earlier contain an authorization issue vulnerability. This vulnerability arises because a six-digit reservation PIN can be brute-forced online. Attackers can obtain customer reservation access tokens across tenants, access their end-to-end encrypted...

PT-2026-130622

Уязвимость программного обеспечения выявления уязвимостей и ошибок PT Application Inspector связана с недостаточной защитой регистрационных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации...

Oracle WebCenter Sites (October 2026 CPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites Apache Log4j...

Red Hat: CVE-2026-55888: xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...

Flatpak xdg-desktop-portal path traversal vulnerability

Versions of Flatpak prior to xdg-desktop-portal 1.22.1 contain a path traversal vulnerability. This vulnerability arises because the FileChooser.SaveFiles method fails to validate filenames. Malicious sandbox applications can exploit this method to gain arbitrary file access on the host system, b...

PT-2026-121739

Name of the Vulnerable Software and Affected Versions Okta Access Gateway versions prior to 2026.10.2 Description An input validation issue in the Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can exploit this to execute system...

PT-2026-121783

Name of the Vulnerable Software and Affected Versions ASUS Router affected versions not specified Description Improper authentication in router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, which enables the execution of administrator operations...

Super Store Finder 3.8 SQL Injection

Super Store Finder version 3.8 suffers from multiple remote SQL injection vulnerabilities. Exploit Title: Super Store Finder 3.8 - Multiple SQL Injection Exploit Author: CraCkEr Date: 26/08/2026 Vendor: highwarden Vendor Homepage: https://codecanyon.net/item/super-store-finder/3630922 Software...

PT-2026-122415

Summary /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which...

Quantum Secret Sharing from CSS QLDPC Codes: Computable Access Structures, Accessible Logical Dimension, and Topology-Aware Network Cost

Quantum secret sharing QSS schemes can be constructed from quantum error-correcting codes, but characterizing their access structures and implementation costs becomes challenging for finite-length, high-rate quantum low-density parity-check qLDPC codes. We develop an exact computational framework...

Intranda goobi-viewer-core input validation error vulnerability

Versions of Intranda Goobi Viewer Core prior to 26.05 contain a security vulnerability. This vulnerability arises because the RSS servlet RssResolver, GET /rss/ fails to validate the q and filterQuery parameters and incorporates them into the Solr query. As a result, unauthenticated attackers may...

ASUS Router authorization issue vulnerability

The ASUS Router 3.0.0.6102 series version contains an authorization issue vulnerability. This vulnerability stems from improper authentication; unauthenticated neighboring attackers can send HTTP requests and forge access tokens, thereby executing administrator actions...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.6.160, 6.12.113, 6.18.57, and 7.2.11. This vulnerability stems from multiple issues related to locking behavior, including RCU access being unprotected by locks...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability stems from the failure to validate the size of BASEERROREVENT payloads. The notification parser fails to verify whether the received payload contains a...

OpenStack Ironic permission and access control issues vulnerability

Vulnerabilities related to permission and access control exist in OpenStack Ironic versions from 17.0.0 up to and including 29.1.1, from 30.0.0 up to and including 32.1.1, from 33.0.0 up to and including 35.1.1, and from 36.0.0 up to and including 39.0.1. These vulnerabilities arise because users...