PT-2026-99108

Name of the Vulnerable Software and Affected Versions RustDesk versions prior to 1.5.0 Description On Linux and macOS, the Cliprdr message handler fails to properly validate file transfer permissions for incoming file clipboard messages. This allows authenticated remote peers, even those with fil...

PT-2026-98983

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

CVE-2026-56726: Missing Authorization

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

CVE-2026-63006: Improper Limitation of a Pathname to a Restricted Directory

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2025-51457

The D-Link DAP-2610 router, running firmware version up to 2.06B08r099 , is susceptible to an authenticated command injection vulnerability. This flaw exists within the web interface at the /index.xgi endpoint, where an attacker with valid credentials can exploit specific parameters to execute ar...

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

PT-2026-98994

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

PT-2026-98868

Name of the Vulnerable Software and Affected Versions FTM versions 4.x Description An XML external entity XXE injection flaw allows a remote authenticated attacker to obtain sensitive information. XXE is a type of attack that occurs when an application processes XML input containing a reference t...

PT-2026-98977

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

PT-2026-98846

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description The tag selector component located at var/www/static/js/tags.js is susceptible to stored cross-site scripting XSS. An authenticated user with permissions to create custom tags can embed...

PT-2026-98984

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-56730: Missing Authorization

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a...

CVE-2026-84464: Exposure of Sensitive Information to an Unauthorized Actor

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

CVE-2026-93365: Missing Authorization

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

CVE-2026-49469: Improper Neutralization of Special Elements used in an LDAP Query

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...

CVE-2026-19775: Missing Authorization

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-45801: Improper Privilege Management

GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue...

PT-2026-98854

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Insecure deserialization occurs in the Quartz JDBC job store. An authenticated attacker can exploit this flaw to execute arbitrary code on the affected system. Deserialization is the proces...