CVE-2026-65938: Missing Authorization

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-73264: Server-Side Request Forgery (SSRF)

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

CVE-2026-12976: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-19050: Server-Side Request Forgery (SSRF)

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

CVE-2026-18433: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

CVE-2026-6821: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a...

CVE-2026-19643: Out-of-bounds Read

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862...

CVE-2026-19642: Out-of-bounds Write

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version...

CVE-2026-19228: Authorization Bypass Through User-Controlled Key

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information...

CVE-2026-66380: Missing Authorization

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...

CVE-2026-66379: Missing Authorization

An authenticated user may view private Puppet module metadata without repository read access...

CVE-2026-66378: Missing Authorization

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

CVE-2026-16494: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a proje...

CVE-2026-66382: Improper Limitation of a Pathname to a Restricted Directory

An authenticated user may write files outside the intended Artifactory work directory under specific conditions...

CVE-2026-48550: Improper Neutralization of Input During Web Page Generation

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim'...

PT-2026-71352

Name of the Vulnerable Software and Affected Versions IBM DOORS Next versions 7.0.3 through 7.0.3 Interim Fix 018 Description An authenticated user can bypass security logic to perform unauthorized activities. Recommendations Update IBM DOORS Next to a version later than 7.0.3 Interim Fix 018...

CVE-2026-18046: Incorrect Authorization

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

PT-2026-71219

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user could cause AI usage to be attributed to another namespace. This occurs due to improper authorization of...

CVE-2026-68969: Insertion of Sensitive Information into Log File

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

PT-2026-71104

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private OCI Open Container Initiative referrer metadata under specific conditions. OCI...