EUVD-2026-89996

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding CWE-177. An...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396

bbs-go through version 4.4.6 is vulnerable to a permission bypass within the AdminMiddleware authorization logic. The root cause is that the dashboard.user.view permission rule incorrectly matches the /api/admin/user/synccount endpoint before the required dashboard.user.update rule is evaluated. ...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

Important: Red Hat Security Advisory: dogtag-pki security update

An update for dogtag-pki is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

CVE-2026-96827

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

CVE-2026-76504

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-76504

A critical authentication bypass vulnerability exists in the Cisco Catalyst SD-WAN Manager API session-based authentication management. The root cause is improper handling of URI encoding (CWE-177) in HTTP requests, allowing an unauthenticated, remote attacker to bypass authentication rules and g...

CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

EUVD-2026-89950

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-96827 WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

CVE-2026-96827 WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

EUVD-2026-89879

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

CVE-2026-96827

The WordPress Admin Notices Manager plugin (versions

CVE-2026-13720

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

EUVD-2026-89615

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...