PT-2026-107126

Name of the Vulnerable Software and Affected Versions AOS-S affected versions not specified Description A privilege escalation issue exists in the API of AOS-S. This flaw allows an authenticated user with read-only permissions to elevate their privileges and obtain full administrative access to t...

PT-2026-106848

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2025-71384

The Dbit WIFI4 N300 1.0.0 devices are vulnerable to a stack-based buffer overflow in the /api/addStaticDHCP comment field. This flaw allows administrators connected to the local Wi-Fi network to achieve remote code execution by executing arbitrary OS commands. While a proof of concept is mentione...

PT-2026-107289

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORT LOCAL PATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

PT-2026-107157

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

CVE-2026-105783: Origin Validation Error

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

WP < 7.1.3 - Author+ Sticky Post via REST API

Description WordPress does not correctly verify user capabilities before allowing a post to be set as sticky via the REST API in some cases, which could allow users with Author-level access and above to feature their own posts on the site front page, an action intended to require higher privilege...

CVE-2026-102407: Incorrect Authorization

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

CVE-2026-105305: Improper Authentication

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2025-71384: Stack-based Buffer Overflow

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

CVE-2026-79818: Missing Authentication for Critical Function

A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to obtain sensitive information from the affected system...

CVE-2026-105486: Missing Authentication for Critical Function

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-86684: Incorrect Authorization

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-105795: Improper Limitation of a Pathname to a Restricted Directory

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-104073: Exposure of Resource to Wrong Sphere

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

PT-2026-106460

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

PT-2026-106362

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

PT-2026-107216

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description An authentication bypass exists in an API interface that allows an unauthenticated remote attacker to circumvent authentication controls. This could enable the attacker to...

PT-2026-107170

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

PT-2026-106806

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...