CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

EUVD-2026-72867

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

CVE-2026-86731

Craft CMS versions 5.0.0-RC1 through 5.10.11 contain a permission escalation flaw in UsersController::actionActivateUser (the users/activate-user action). The action requires the administrateUsers permission but fails to call requireAdmin() when the targeted user is an administrator, unlike the s...

EUVD-2026-72805

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

EUVD-2026-72534

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

PT-2026-87128

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.11 Description An authenticated control panel user with the administrateUsers permission can activate a pending or deactivated administrator account. This occurs because the...

CVE-2026-78216: Insufficient Granularity of Access Control

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

CVE-2026-73319: Improper Neutralization of Input During Web Page Generation

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2026-86541

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() MCP handler function. Attackers can supply absolute paths or relative paths with directory traversal sequences to overwrite arbitrary files outside the project root, potentially writing malicious conte...

CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2026-86438

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438

Lara Dashboard versions prior to 1.3.2 contain an authorization bypass in the MarketplaceModuleBrowser Livewire component. The installModule action fails to restrict access to Superadmin-level roles, allowing any authenticated non-Superadmin administrator to trigger module installation. Because m...

Malicious Package

Overview github-app-sts-action is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CERTFR-2026-ACT-038

creationtimestamp| type| source ---|---|--- 2026-09-07 13:16:34+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3muwlqpl73d2v 2026-09-07 13:16:41+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/117229944394912620...

PT-2026-86651

Interesting GitHub Security Lab disclosure: same-second TOCTOU in jupyterlab/maintainer-tools update-snapshots-checkout CVE-2026-84973. Race between checkout and snapshot update. Window is measured in the same second the workflow runs. Classic TOCTOU, but in a maintainer tooling path that many...

PT-2026-86921

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86290: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=savecategory. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available ...