PT-2026-121484

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

PT-2026-121507

Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in different execution contexts. This only poses a security issue if the IP address of the attacked executor is know and...

PT-2026-120931

Name of the Vulnerable Software and Affected Versions Traefik version 3.7.13 Description An access-control bypass exists in the Kubernetes Ingress NGINX provider. The HTTP router created for ssl-passthrough Ingresses on non-TLS entry points fails to apply access-control annotations. This allows...

PT-2026-121297

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

PT-2026-121298

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

PT-2026-121368

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

PT-2026-121372

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch organization...

WatchGuard Agent permission and access control issue vulnerability

Versions of WatchGuard Agent prior to 1.25.14.0000 contain a privilege escalation and access control vulnerability. This vulnerability stems from improper permission allocation within the log directory, potentially allowing locally authenticated non-administrator users to create, modify, append, ...

Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in ChangeUserOrganizationView.post, allowing authenticated users to join any organization by providing a UUID. Once attackers obtain other organizations’ UUIDs, th...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from an authentication bypass flaw in the PAPI protocol, allowing unauthenticated attackers at adjacent locations to circumvent authentication controls. This could enable attackers to gain administrative access, modify system configurations...

KiloView E3 Firmware session mechanism vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a vulnerability related to the session mechanism. This vulnerability arises because authentication tokens issued during login on the web management interface have an expiration time far exceeding the typical duration of a valid session. A...

hwk-fr ACF Extended authorization issue vulnerability

The hwk-fr ACF Extended versions 0.9.2.7 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control security levels...

WordPress User Profile Builder permission and access control issue vulnerability

WordPress User Profile Builder versions 4.0.4 and earlier contain a privilege escalation vulnerability related to permission handling and access control. This issue stems from improper permission allocation and may lead to privilege escalation...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to insufficient protection of service data. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

rdpecam module RDP Client Unauthorized Access

The vulnerability of the rdpecam module in the RDP client FreeRDP is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a specially crafted request...

LXC Incus trust management issue vulnerability

Versions LXC Incus prior to 6.0.3 through 6.0.7, 6.6.0 through 7.0.2, and 7.1.0 through 7.5.0 contain a trust management vulnerability stemming from improper authorization. This allows restricted TLS clients to read bucket keys stored in default projects. Attackers can query the bucket key endpoi...

Drupal Webform permission and access control issues vulnerability

Drupal Webform versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 contain a vulnerability related to permission and access control issues. This vulnerability stems from unsafe operations in permission definitions, potentially leading to stored cross-site scripting attacks...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142762)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142762 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing...