PT-2026-96757

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

CVE-2026-18169: Improper Limitation of a Pathname to a Restricted Directory

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

PT-2026-96689

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.17 Erlang/OTP versions 28.0 through 28.5.0.6 Erlang/OTP versions 29.0 through 29.1.0 ssh versions 3.0.1 through 5.2.11.12 ssh versions 5.3.0 through 5.5.2.5 ssh versions 6.0.0 through 6.0.5 Description A...

CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

PT-2026-96728

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description The queryEnrichment function in EventsController.php fails to properly validate the module name parameter. When a module name is provided that is not in the list of enabled modules, the system...

CVE-2026-18156: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...

CVE-2026-95674: Improper Input Validation

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

CVE-2026-90990: Improper Neutralization of CRLF Sequences

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk 2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services...

CVE-2026-79913: Server-Side Request Forgery (SSRF)

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated...

PT-2026-97097

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper authorization in the software allows a remote authenticated attacker to bypass security controls by forging user identities...

CVE-2026-89282: Incorrect Permission Assignment for Critical Resource

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...

CVE-2026-95701: Improper Limitation of a Pathname to a Restricted Directory

In MISP, the statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image. The original code called fileexists with a path constructed as APP . 'webroot' . DS . 'img' . DS . 'orgs' . ...

PT-2026-96770

In MISP, the statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image. The original code called file exists with a path constructed as APP . 'webroot' . DS . 'img' . DS . 'orgs'...

CVE-2026-88419

WuzhiCMS version 5.0.0 is vulnerable to an unrestricted file upload via the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload). The application fails to perform content validation or use an extension allowlist, taking the file extension verbatim from the client-supplied filen...

CVE-2026-95655: Authorization Bypass Through User-Controlled Key

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes ...

PT-2026-96724

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1 Description An authenticated user can cause excessive database load by...

Linux Distros Unpatched Vulnerability : CVE-2026-94572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is...

PT-2026-96825

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description The 'POST /login' endpoint in lightrag/api/lightrag server.py does not implement rate limiting, account lockout, delays, or counters for failed authentication attempts. This allows a network attacke...

CVE-2026-17472: Improper Privilege Management

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions...

CVE-2026-94532

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresse...