Authlib configuration error vulnerability

Versions of Authlib prior to 1.9.0 contain a security vulnerability. This vulnerability arises because the default JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only the presence of an audience claim without verifying it against the current...

Drupal Editoria11y Accessibility Checker permission and access control issues vulnerability

Drupal Editoria11y Accessibility Checker versions prior to 0.0.0 and from 2.2.23 up to 3.0.0, as well as versions from 3.0.0 up to 3.0.9, contain a permission and access control vulnerability. This vulnerability stems from unsafe operations within permission definitions, potentially leading to...

Apache Abdera input validation error vulnerability

All versions of Apache Abdera contain an input validation error vulnerability. This vulnerability stems from improper restrictions on XML external entity references. When the application uses Abdera to parse XML controlled by attackers, it may allow attackers to access sensitive data or initiate...

PT-2026-121382

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2...

PT-2026-121311

Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.0...

WordPress SureDash authorization issue vulnerability

WordPress SureDash versions 1.12.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

VulnCheck KEV: CVE-2026-13756

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the update handler for the /wp-json/wpgb/v2/metadata REST endpoint. This makes it possible for authenticated...

PT-2026-121287

Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

PT-2026-121479

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions 3.3.0 through 3.10.7 PhpSpreadsheet versions prior to 5.10.0 Description Processing attacker-controlled SpreadsheetML XML can lead to entity-expansion denial of service, local file access, or Server-Side Request Forgery...

CrowdStrike Channel File 291: An Engineering Analysis of a Global Endpoint Outage

On July 19, 2024, a CrowdStrike Falcon content update caused Windows systems to crash, affecting about 8.5 million devices according to a Microsoft estimate. The immediate defect was an inconsistency between a detection template that declared 21 inputs and sensor code that supplied 20. A new...

PT-2026-121675

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description The default JWTBearerGrant.get audiences function returns an empty list, which leads JWTBearerGrant.verify claims to only check for the existence of an aud claim without verifying if it matches the...

ROS-20261022-73-0019

The vulnerability of the RDPDR IRP RDP-client FreeRDP module is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain access to read, write, and delete arbitrary files...

Linux Distros Unpatched Vulnerability : CVE-2026-91373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142759)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142759 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 nvme-tcp: fi...

ROS-20261022-73-0066

The vulnerability of the Portainer container management platform is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142502)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142502 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

PT-2026-121308

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

PT-2026-121484

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...