SUSE CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

EUVD-2026-57240

A Project Resource Manager may gain broader administrative privileges under specific conditions...

CVE-2026-73290 RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...

EUVD-2026-57235

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...

EUVD-2026-57234

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

EUVD-2026-57217

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-47231

CVE-2026-47231 (Admidio) : The vulnerability is an IDOR in modules/documents-files.php (mode=move_save). The move operation validates rights only on the destination folder, not the source containing the file, enabling a user with a single folder upload right to move files out of private folders a...

CVE-2026-18652 Velociraptor STACK Type Download Path Bypasses Denied Prefix Check

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...

CVE-2026-18035

The User Access Manager WordPress plugin (versions before 2.3.15 ) is vulnerable to an unauthenticated restricted content disclosure via the REST API . The root cause is the plugin's failure to apply access restrictions to REST API requests, which allows attackers to read the content of posts , p...

CVE-2026-18035 User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups...

EUVD-2026-57008

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-72796: Missing Authorization

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifact...

PT-2026-71241

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description In publish mode, when the Publish.Auth.Enable variable is set to false, the software fails to enforce publish-access filters on five filetree path-resolution endpoints: 'getFullHPathByID',...

PT-2026-71101

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An unauthenticated user may access restricted repository information under specific conditions. Recommendations At the moment, there is no information about a...

PT-2026-71238

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An access control bypass exists in the server mux where several static-file routes bypass the publish-access controls enforced on the REST API. This allows attackers with publish reader tokens or...

PT-2026-76592

Name of the Vulnerable Software and Affected Versions Drupal Diff versions 0.0.0 through 2.0.1 Drupal Diff versions 2.1.0 through 2.1.1 Description An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This...

PT-2026-71142

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

PT-2026-71093

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy allowed path applies deny anonymo...

TencentOS Server 4: pcp (TSSA-2026:0829)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0829 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-29036 cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...