PT-2026-121368

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

PT-2026-121372

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch organization...

WatchGuard Agent permission and access control issue vulnerability

Versions of WatchGuard Agent prior to 1.25.14.0000 contain a privilege escalation and access control vulnerability. This vulnerability stems from improper permission allocation within the log directory, potentially allowing locally authenticated non-administrator users to create, modify, append, ...

Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in ChangeUserOrganizationView.post, allowing authenticated users to join any organization by providing a UUID. Once attackers obtain other organizations’ UUIDs, th...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from an authentication bypass flaw in the PAPI protocol, allowing unauthenticated attackers at adjacent locations to circumvent authentication controls. This could enable attackers to gain administrative access, modify system configurations...

KiloView E3 Firmware session mechanism vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a vulnerability related to the session mechanism. This vulnerability arises because authentication tokens issued during login on the web management interface have an expiration time far exceeding the typical duration of a valid session. A...

hwk-fr ACF Extended authorization issue vulnerability

The hwk-fr ACF Extended versions 0.9.2.7 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control security levels...

WordPress User Profile Builder permission and access control issue vulnerability

WordPress User Profile Builder versions 4.0.4 and earlier contain a privilege escalation vulnerability related to permission handling and access control. This issue stems from improper permission allocation and may lead to privilege escalation...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to insufficient protection of service data. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

rdpecam module RDP Client Unauthorized Access

The vulnerability of the rdpecam module in the RDP client FreeRDP is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a specially crafted request...

LXC Incus trust management issue vulnerability

Versions LXC Incus prior to 6.0.3 through 6.0.7, 6.6.0 through 7.0.2, and 7.1.0 through 7.5.0 contain a trust management vulnerability stemming from improper authorization. This allows restricted TLS clients to read bucket keys stored in default projects. Attackers can query the bucket key endpoi...

Drupal Webform permission and access control issues vulnerability

Drupal Webform versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 contain a vulnerability related to permission and access control issues. This vulnerability stems from unsafe operations in permission definitions, potentially leading to stored cross-site scripting attacks...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142762)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142762 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing...

Oracle MySQL Connectors NET (October 2026 CPU)

The versions of MySQL Connectors installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Net. The supported version that is affected is 26.7.0...

Linux Distros Unpatched Vulnerability : CVE-2026-83387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JDBC. Supported versions tha...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142510)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142510 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before...

Oracle JDeveloper Multiple Vulnerabilities (October 2026 CPU)

The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: Security...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143081 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the...