CVE-2026-94534

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-78806

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component...

UBUNTU-CVE-2026-79079

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

CVE-2026-94425

CVE-2026-94425 affects the Moore Threads MTT S80 Driver Package 340.150 , specifically the IOCTL Handler in the driver library mtdispkm64.sys (function sub_140006F0C). The root cause is improper privilege management , allowing a local attacker with low privileges to escalate access. The CVSS 3.1 ...

CVE-2026-94534 lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-88403

A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...

CVE-2026-94424

CVE-2026-94424 affects the Moore Threads MTT S80 Driver Package up to version 340.150 . The vulnerable component is the function sub_140001000 in the kernel-mode library mtdispkm64.sys , specifically within the IOCTL Handler , where a heap-based buffer overflow can be triggered through manipulati...

CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-81469

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges...

CVE-2026-85219 Denial-of-Service in the OpenCanary Redis service

Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage...

CVE-2026-81469

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges...

CVE-2026-94495

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...

CVE-2026-82165

Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-49810

Dell Command Powershell Provider DCPP, versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-77582

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...

redis: Redis: Out-of-bounds read via crafted cluster bus packets

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free

A flaw was found in Redis. This vulnerability, a use-after-free, exists within the tlsProcessPendingData function, which manages the Transport Layer Security TLS pending-data list when Redis is configured with TLS support. A remote, unauthenticated attacker could exploit this to execute...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 ( runtime, metadb, ui, spark) images by vulnerabilities in gnupg2 package

Summary Impacted IBM Optim 1.0.0, 1.1.0 runtime, metadb, ui, spark images by vulnerabilities in gnupg2 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the packages to fixed versions 2.3.3-5.el97. Vulnerability Details CVEID:CVE-2025-68973 DESCRIPTION: In GnuPG before 2.4.9,...

CVE-2026-61687

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...