CVE-2026-86190: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

PT-2026-86419

Name of the Vulnerable Software and Affected Versions Grav Form Plugin versions prior to 9.1.22 Description Insufficient page authorization verification occurs when resolving forms by name across pages. This allows anonymous visitors to execute form actions—such as saving, uploading, emailing, or...

Linux Distros Unpatched Vulnerability : CVE-2026-84989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature...

PT-2026-86383

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

EUVD-2026-71799

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...

CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...

CVE-2026-86091

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

CVE-2026-86090

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

EUVD-2026-57455

SiYuan: Embedded transclusion block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers...

EUVD-2026-71715

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-61688

SolidInvoice , an open-source invoicing platform, is affected by a cross-user information disclosure vulnerability prior to version 3.0.1 . An authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveCom...

CVE-2026-80871

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove cryptorng interface Implementing the cryptorng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually...

CVE-2026-80871

CVE-2026-80871 affects the Linux kernel 's xilinx-trng crypto driver. The crypto_rng interface implemented by the driver was unused in practice and carried two latent bugs: (1) xtrng_trng_generate() could return success without filling all requested bytes, and (2) broken locking in xtrng_hwrng_tr...

CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove cryptorng interface Implementing the cryptorng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually...

EUVD-2026-71501

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove cryptorng interface Implementing the cryptorng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually...

CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove cryptorng interface Implementing the cryptorng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually...

CVE-2026-75167

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

CVE-2026-85619

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...