CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

EUVD-2026-72867

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

CVE-2026-86731

Craft CMS versions 5.0.0-RC1 through 5.10.11 contain a permission escalation flaw in UsersController::actionActivateUser (the users/activate-user action). The action requires the administrateUsers permission but fails to call requireAdmin() when the targeted user is an administrator, unlike the s...

CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

EUVD-2026-72805

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

EUVD-2026-72534

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

PT-2026-87128

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.11 Description An authenticated control panel user with the administrateUsers permission can activate a pending or deactivated administrator account. This occurs because the...

CVE-2026-73319: Improper Neutralization of Input During Web Page Generation

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-78216: Insufficient Granularity of Access Control

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2026-86541

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() MCP handler function. Attackers can supply absolute paths or relative paths with directory traversal sequences to overwrite arbitrary files outside the project root, potentially writing malicious conte...

CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2026-86438

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438

Lara Dashboard versions prior to 1.3.2 contain an authorization bypass in the MarketplaceModuleBrowser Livewire component. The installModule action fails to restrict access to Superadmin-level roles, allowing any authenticated non-Superadmin administrator to trigger module installation. Because m...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CERTFR-2026-ACT-038

creationtimestamp| type| source ---|---|--- 2026-09-07 13:16:34+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3muwlqpl73d2v 2026-09-07 13:16:41+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/117229944394912620...

CVE-2026-86290: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=savecategory. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available ...

CVE-2026-86234: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...