Linux Distros Unpatched Vulnerability : CVE-2026-74994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collaps...

PT-2026-85036

CRMEB through 6.0.0 fails to validate message ownership in the edit message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is del, look, and uid to delete, mark read, or reassign...

PT-2026-84907

Cheshire Cat AI's GET /memory/collections/collection id/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...

PT-2026-85098

Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...

PT-2026-85093

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

PT-2026-85207

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

CVE-2026-84777: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

PT-2026-85113

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

HP Easy Start for macOS 2.16.x Privilege Escalation

HP Easy Start for macOS versions prior to 2.16.7.260722 suffer from multiple broken privilege boundary issues...

PT-2026-85121

Unauthenticated Broken Access Control in Quick Event Manager = 9.17 versions...

CVE-2026-84215: Missing Authorization

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-84238: Missing Authorization

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...

CVE-2026-85157: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

CVE-2026-84758: Missing Authorization

Unauthenticated Broken Access Control in Business Directory = 6.4.26 versions...

CVE-2026-84755: Missing Authorization

Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...

CVE-2026-84754: Missing Authorization

Unauthenticated Broken Access Control in WPFunnels = 3.12.13 versions...

CVE-2026-84779: Missing Authorization

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

CVE-2026-82023: Incorrect Authorization

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

PT-2026-85222

Name of the Vulnerable Software and Affected Versions Worklenz versions prior to 3.0.0 Description An authorization bypass exists when resolving task-scoped API endpoints because the system fails to verify task ownership by organization. This allows authenticated users to access task data belongi...

PT-2026-84988

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...