CVE-2026-71506

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.28 fixes various security issues: The following security issues were fixed: CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024...

EUVD-2026-65078

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-71505

Dolibarr before 24.0.0 is affected by a Broken Object-Level Authorization (BOLA) vulnerability in the REST API third-party site account write routes . Per-object access checks are enforced only on read routes, leaving write endpoints unguarded. An authenticated attacker holding third-party creati...

CVE-2026-39975 Combodo iTop: Remote code execution using external auth variable value

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in versi...

CVE-2026-39975

Combodo iTop , a web-based IT service management tool, is vulnerable to remote code execution prior to version 3.2.3 . The root cause involves the ability of unauthenticated users to delete the .readonly file , which is created during setup to prevent write actions on the instance. Per the CVELIS...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

CVE-2026-71940

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the aclgeneralsetup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causi...

CVE-2026-71912

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of...

CVE-2026-71911

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

EUVD-2026-65060

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073

Label Studio (through 1.23.0 ) has a broken access control flaw in its annotation detail endpoint. The AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() without a get_queryset override, so any annotation is retrievable by primary key. Because permissions are ...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...

CVE-2026-77915

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was...

CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

CVE-2026-13213

Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server (subsys/bluetooth/audio/has.c) contains a NULL-pointer dereference in security_changed(). The connection-callback set is installed unconditionally via BT_CONN_CB_DEFINE, so the callback fires before the application calls bt_has_regist...