CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

EUVD-2026-57455

SiYuan: Embedded transclusion block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers...

EUVD-2026-57456

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers...

EUVD-2026-57459

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers...

CVE-2026-53769

Avo , a Ruby on Rails admin panel framework, contains a missing server-side authorization vulnerability in Avo::AttachmentsController#create (the direct attachment upload endpoint) affecting versions 2.28.0 through before 3.32.0 . The endpoint creates an ActiveStorage::Blob before validating the ...

CVE-2026-80112

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-80112 PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...

EUVD-2026-71683

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...

CVE-2026-80112

PassMark PerformanceTest , BurnInTest , and OSForensics each ship a vulnerable DirectIo64.sys kernel driver. The root cause is an improper access control flaw: the device object is created without a security descriptor, so Windows applies a permissive default ACL . This allows unprivileged local ...

MGASA-2026-0376 Updated tomcat packages fix security vulnerabilities

Incorrect URL decoding in RewriteValve may allow security control bypass. CVE-2026-59083 EncryptInterceptor requirements not clearly documented. CVE-2026-59084 DoS via WebSocket chat example. CVE-2026-66299 Bypass longest prefix security constraint. CVE-2026-65182 TOCTOU when setting specific...

CVE-2026-61688

SolidInvoice , an open-source invoicing platform, is affected by a cross-user information disclosure vulnerability prior to version 3.0.1 . An authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveCom...

CVE-2026-17483

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure...

CVE-2026-13297

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack...

EUVD-2026-71493

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack...

CVE-2026-13297

IBM Verify Identity Access and IBM Security Verify Access contain an information disclosure vulnerability in the Advanced Access Control component. The flaw can be exploited over the network with low complexity, requires no prior authentication, and results in a high impact to confidentiality wit...

CVE-2026-13297 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack...

CVE-2026-17483 IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure...

CVE-2026-17483

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by an improper authorization flaw (CWE-285) in an SQL procedure, allowing a local attacker to delete historical flight-recorder archives. The CVSS v3.1 score is 4.3 (Medium) with a network vector, low complexity, and low privileges requ...