EUVD-2026-64679

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78203

Ghostwriter before 7.1.2 contains a cross-client authorization flaw in the report template swap endpoint . The endpoint fails to validate template ownership, and because template primary keys are sequential, an authenticated attacker can enumerate and attach templates belonging to other clients t...

EUVD-2026-64678

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

CVE-2026-7878-eBPF-Verifier-Type-Confusion-Kernel-Memory-Read-Write

6. CVE-2026-7878 – Confusion de type dans le vérificateur eBPF → Lecture/écriture mémoire noyau Vue d'ensemble Un débordement d'entier subtil dans le suivi des bornes du vérificateur eBPF permet à un attaquant de créer un programme eBPF qui accède à de la mémoire noyau hors limites. Sévérité :...

CVE-2025-32463

CVE-2025-32463 - Nessun gcc richiesto Escalation dei privilegi a root tramite sudo, senza NESSUNA NECESSITÀ di avere gcc installato sul target. Scoperto da Rich Mirch. Ho scritto un articolo che spiega la mitigazione dell'attacco qui: Ubuntu Unattended-Upgrades Versioni Affette Vulnerabile: sudo...

PT-2026-80914

NetworkManager did not apply the private user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

PT-2026-79818

Name of the Vulnerable Software and Affected Versions 4MOSAn GCB Doctor affected versions not specified Description An OS Command Injection issue exists where unauthenticated remote attackers can execute arbitrary system commands on the server. This is possible through a parameter in an unremoved...

PT-2026-80825

Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and...

PT-2026-81050

Name of the Vulnerable Software and Affected Versions MagicAI for WordPress versions 1.4 and earlier Description A Local File Inclusion issue exists that allows users with Subscriber privileges to read arbitrary files on the server. Recommendations Update MagicAI for WordPress to a version later...

PT-2026-81049

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

PT-2026-81046

Name of the Vulnerable Software and Affected Versions WooBeWoo Product Filter Pro versions prior to 3.1.9 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes t...

PT-2026-79837

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

Cisco Catalyst SD-WAN Manager Information Disclosure (cisco-sa-sdwan-infodis-SPuJBDCe)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - An information disclosure vulnerability exists in the web-based management interface of Cisco Catalyst SD-WAN Manager due to insufficient access control enforcement for specific template types...

PT-2026-81045

Name of the Vulnerable Software and Affected Versions Style Kits versions prior to 2.6.6 Description Broken Access Control allows a user with Subscriber privileges to perform unauthorized actions. Recommendations Update Style Kits to version 2.6.6 or later...

PT-2026-80858

Name of the Vulnerable Software and Affected Versions miniOrange OAuth Client versions prior to 3.2.0 Description An issue in the miniOrange OAuth Client extension for Joomla allows an attacker to log in as any account, including administrators, without requiring a valid account or prior...

PT-2026-80903

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...

CVE-2026-75371

An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software (commit eaf90ec) allows physically-proximate attackers with UART access to trigger a Denial of Service via a crafted input. The CISA SSVC assessment rates exploitation status as proof-of-concept , automatable, ...

CVE-2026-75371

An integer handling flaw in the cobsdecode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a Denial of Service DoS via a crafted input...

PT-2026-80904

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...