CVE-2026-42210

Webmin prior to 2.640 contains a 2FA bypass where an attacker who knows a valid Webmin username and password can bypass the second authentication factor by authenticating with Basic authentication. The issue is documented with a CVSS 4.0 vector and a base score of 5.3 (MEDIUM). The recommended re...

CVE-2026-39385 Frappe LMS enrollment bypass in paid courses via unrelated batch

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...

CVE-2026-39385

CVE-2026-39385 — Frappe LMS : Open-source LMS with a vulnerability in versions ≤ 2.51.0 where a user could bypass course payment validation by using an unrelated batch. Root cause: enrollment validation did not require the batch to be linked to the corresponding course. Impact: potential unauthor...

CVE-2026-41521

CVE-2026-41521 – xrdp is affected in versions up to 0.10.6, where an integer overflow in processing screen update messages within the vnc-any connection mode can lead to an undersized allocation and an out-of-bounds read. This can allow an unauthenticated remote attacker to disclose heap memory o...

CVE-2026-35048

The CVE affects the Piwigo installer (versions 16.3.0 and earlier) where POST parameters for database configuration are written directly into local/config/database.inc.php without proper sanitization. The issue arises because on PHP 8+, addslashes() no longer provides protection after get_magic_q...

CVE-2026-32821 API Collection Impersonation Via user_email And Missing Object- Level Authorization

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the...

CVE-2026-32806 dataCycle Authorization Bypass Via /remote_render

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backe...

CVE-2026-32806

CVE-2026-32806 affects dataCycle-CORE prior to version 26.06.08, where an authenticated user can abuse /remote_render to request arbitrary partials or helper-backed render functions, bypassing controller authorization and exposing admin content (e.g., PostgreSQL dashboard stats) that should be re...

CVE-2026-32807

CVE-2026-32807 affects dataCycle-CORE prior to 25.07.3, where any user with a DataLink UUID can fetch an attached text file directly, even if expired or unauthenticated. The route is public and mailers embed the direct URL, allowing leaked or forwarded links to expose the attachment. Impact is co...

CVE-2026-32807 dataCycle Public DataLink Text File Download Ignores Validity And Authorization

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...

CVE-2026-27823

CVE-2026-27823 affects EGroupware. The issue arises from improper authorization checks in SmallPartMediaRecorder::ajax_upload, combined with a file write primitive and an arbitrary file read vulnerability, enabling an authenticated attacker to upload to a controllable path, read sensitive files (...

CVE-2026-63091

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

CVE-2026-13724

Technical details about CVE-2026-13724 are not publicly available in the provided documents. The description mentions a client-side bypass and input manipulation in Gobito's Corporate Training Management System, but no concrete affected versions or remediation are disclosed. Monitor for updates.

EUVD-2026-45962

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

CVE-2026-63091

ProFTPD mod_sftp in versions before 1.3.9c and 1.3.10rc3 contains a signed integer overflow in the SCP size-record parser. An authenticated, low-privilege attacker can send a crafted file size (UINT64_MAX) to produce a negative off_t, convert to uint32_t, and trigger ~4 GB read length, causing th...

EUVD-2026-45961

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...

nodejs: Node.js: Certification validation bypass in TLS host verification

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...

nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS Transport Layer Security hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security...

CVE-2026-53367

A flaw was found in the Linux kernel's Security-Enhanced Linux SELinux subsystem. The per-task avdcache access vector cache incorrectly stored and reused auditing information. This prevented some critical security permission checks, such as directory write operations, from being properly audited...