CVE-2026-19840

The Notiqoo WordPress plugin (specifically the Order Notification & Customer Chat for WooCommerce plugin) versions before 1.4.14 is vulnerable to an incorrect authorization flaw. The plugin fails to perform adequate capability checks on several of its AJAX actions and constructs the name of the o...

EUVD-2026-75257

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0308

This CVE entry is reserved with no public technical details yet. The affected product, root cause, and impact are not specified in the provided documents. Monitor for updates as details are expected once the vulnerability is publicly announced.

EUVD-2026-75256

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

Exploit for CVE-2026-86060

CVE-2026-86060 — MikroTik RouterOS SSH Pre-Authentication Priv...

PT-2026-89592

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

CVE-2026-88959: Missing Authorization

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-88924: Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

JetBrains YouTrack < 2026.1.14047 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.14047. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

PT-2026-89290

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

PT-2026-89320

GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker...

PT-2026-89374

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/ backend/private/invite new user to org.ts. The POST /private/invite new user to org endpoint only requires the org.update...

PT-2026-89551

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store meta page title or meta page favicon through /api/admin/system-preferences, and MetaGenerator inserts those values into...

PT-2026-89322

GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker...

PT-2026-89351

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

PT-2026-89291

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

MGASA-2026-0389 Updated ceph packages fix security vulnerabilities

Updated ceph packages fix various security issues allowing authentication bypasses to gain admin privileges on the OSD, MDS, and MGR services. Notice that some of the fixes require kernel support for aes256k introduced in kernel 7. This update will not break installs using the old and insecure AE...

GHSA-HXJG-93WC-H8P8 Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...