PT-2026-80903

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...

PT-2026-80858

Name of the Vulnerable Software and Affected Versions miniOrange OAuth Client versions prior to 3.2.0 Description An issue in the miniOrange OAuth Client extension for Joomla allows an attacker to log in as any account, including administrators, without requiring a valid account or prior...

CVE-2026-75371

An integer handling flaw in the cobsdecode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a Denial of Service DoS via a crafted input...

PT-2026-80888

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.2 Description An authentication bypass exists in the REST API due to an insecure object cache keying mechanism. The cache uses only the lookup value as a key and fails to include the searched column. This allows a...

CVE-2026-75371

An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software (commit eaf90ec) allows physically-proximate attackers with UART access to trigger a Denial of Service via a crafted input. The CISA SSVC assessment rates exploitation status as proof-of-concept , automatable, ...

The vulnerability of the Erlang programming language, related to incorrect authorization, allows attackers to gain access to confidential data and influence its integrity.

The vulnerability of the Erlang programming language is related to improper authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential data and influence its integrity...

The vulnerability in the soup-server-connection.c component of the LibSoup access library allows a attacker to cause a service failure.

The vulnerability of the soup-server-connection.c component in the LibSoup access library is related to errors during resource release. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird relates to deficiencies in access control in isolated environments, allowing attackers to trigger a service failure.

The vulnerabilities of the Firefox web browser, Firefox ESR, and the Thunderbird email client are related to deficiencies in access control within isolated environments. Exploiting these vulnerabilities can allow a malicious actor to cause service failures...

ROS-20260824-73-0002

The vulnerability in the incus is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260824-73-0001

The vulnerability in the incus is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules allows attackers to access confidential data.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

CVE-2026-78155

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

EUVD-2026-64648

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

CVE-2026-77116

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116

Brave Popup Builder (WordPress plugin, slug: brave-popup-builder) versions through 0.8.5 contain a broken access control vulnerability. Any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) can read unpublished popup content by passing a post ID in the URL, effecti...

CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853

WooCommerce Bookings (WordPress plugin) versions before 3.9.0 contain an authorization flaw: one of its AJAX actions lacks a capability check , and the associated nonce check can be bypassed by simply omitting the token. This allows any authenticated user with Subscriber-level access or above to ...