ROS-20261022-73-0062

The vulnerability in Go-Git relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ROS-20261022-73-0101

The vulnerability in Grafana is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

KiloView E3 Firmware Trust Management Vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a trust management vulnerability. This vulnerability arises because the authentication framework uses a HMAC-SHA256 key hardcoded into the firmware image to sign session JSON Web Tokens. Since all deployed devices share this same key,...

PT-2026-121274

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...

PT-2026-121411

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

PT-2026-121312

Name of the Vulnerable Software and Affected Versions ЮKassa для WooCommerce versions prior to 2.17.3 Description An authorization flaw in the yoomoney ЮKassa для WooCommerce plugin allows the exploitation of incorrectly configured access control security levels. Recommendations Update to a versi...

Smile Digital Health HAPI FHIR authorization issue vulnerability

Smile Digital Health HAPI FHIR contains an authorization issue vulnerability. This vulnerability arises because the untrusted bundle body can replace partition identities previously established by a trusted source; by default, storage partition permissions are not enforced. As a result, attackers...

PT-2026-121308

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Windows kernel Unauthorized Access

The vulnerability of Windows operating system kernels relates to the exposure of system data to unauthorized individuals. Exploiting this vulnerability can allow a perpetrator to gain unauthorized access to protected information...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Cisco ISE Policy Runtime Repository Table Unauthorized Access

The vulnerability of the Policy Runtime Repository Table PRRT service on the Cisco Identity Services Engine ISE network management platform, as well as the Cisco ISE Passive Identity Connector ISE-PIC virtual authentication device, is related to the absence of authentication for a critical...

PT-2026-121505

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.87.0 through 1.100.3 LiteLLM versions 1.101.0 through 1.101.2 LiteLLM versions 1.102.0 through 1.102.1 LiteLLM versions 1.103.0 LiteLLM versions 1.104.0-rc.0 through 1.104.0-rc.1 Description LiteLLM reuses a single...

PT-2026-120942

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

Traefik Labs Traefik authorization issue vulnerability

In Traefik Labs Traefik versions 3.7.13 through 3.7.14, there is an authorization issue vulnerability. This vulnerability stems from HTTP router generation in the Kubernetes Ingress NGINX provider for non-TLS ingress points; no access control annotations are applied to generated routes. As a...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw in the web management interface. Authenticated low-privilege attackers with local access can exploit this vulnerability to view certain system files and disrupt the normal operation of affected services...

Authlib configuration error vulnerability

Versions of Authlib prior to 1.9.0 contain a security vulnerability. This vulnerability arises because the default JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only the presence of an audience claim without verifying it against the current...

Drupal Editoria11y Accessibility Checker permission and access control issues vulnerability

Drupal Editoria11y Accessibility Checker versions prior to 0.0.0 and from 2.2.23 up to 3.0.0, as well as versions from 3.0.0 up to 3.0.9, contain a permission and access control vulnerability. This vulnerability stems from unsafe operations within permission definitions, potentially leading to...

Apache Abdera input validation error vulnerability

All versions of Apache Abdera contain an input validation error vulnerability. This vulnerability stems from improper restrictions on XML external entity references. When the application uses Abdera to parse XML controlled by attackers, it may allow attackers to access sensitive data or initiate...

PT-2026-121382

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2...