PT-2026-121284

Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1...

PT-2026-121595

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A buffer overflow exists in the PAPI protocol, which could allow an unauthenticated remote attacker to bypass authentication controls. This could lead to unauthorized administrative access,...

WordPress SureDash authorization issue vulnerability

WordPress SureDash versions 1.12.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

Gitlab Gitlab: CVE-2026-14288: Use of Incorrectly-Resolved Name or Reference

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

OpenBao session mechanism vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a session mechanism vulnerability. This vulnerability arises because, when renewing tokens issued by the Kubernetes Auth method, it fails to verify whether the originally used service account token remains valid. As a resul...

Smile Digital Health HAPI FHIR authorization issue vulnerability

Smile Digital Health HAPI FHIR has an authorization issue vulnerability stemming from improper access control. When REST-hook subscriptions are enabled, users with subscription creation privileges may query and read resources they are otherwise denied access to, resulting in unauthorized access...

ROS-20261022-73-0075

The vulnerability of the extension unit search mechanism for the UVC H.264 RDP client FreeRDP, related to memory reading beyond the allocated range, allows a perpetrator to access potentially confidential data...

ROS-20261022-73-0066

The vulnerability of the Portainer container management platform is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

ROS-20261022-73-0062

The vulnerability in Go-Git relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ROS-20261022-73-0101

The vulnerability in Grafana is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20261022-73-0019

The vulnerability of the RDPDR IRP RDP-client FreeRDP module is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain access to read, write, and delete arbitrary files...

KiloView E3 Firmware Trust Management Vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a trust management vulnerability. This vulnerability arises because the authentication framework uses a HMAC-SHA256 key hardcoded into the firmware image to sign session JSON Web Tokens. Since all deployed devices share this same key,...

PT-2026-121274

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...

PT-2026-121411

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

PT-2026-121312

Name of the Vulnerable Software and Affected Versions ЮKassa для WooCommerce versions prior to 2.17.3 Description An authorization flaw in the yoomoney ЮKassa для WooCommerce plugin allows the exploitation of incorrectly configured access control security levels. Recommendations Update to a versi...

Smile Digital Health HAPI FHIR authorization issue vulnerability

Smile Digital Health HAPI FHIR contains an authorization issue vulnerability. This vulnerability arises because the untrusted bundle body can replace partition identities previously established by a trusted source; by default, storage partition permissions are not enforced. As a result, attackers...

PT-2026-121308

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5...

PT-2026-120942

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

PT-2026-121287

Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

Traefik Labs Traefik authorization issue vulnerability

In Traefik Labs Traefik versions 3.7.13 through 3.7.14, there is an authorization issue vulnerability. This vulnerability stems from HTTP router generation in the Kubernetes Ingress NGINX provider for non-TLS ingress points; no access control annotations are applied to generated routes. As a...