EUVD-2026-88748

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

CVE-2026-101267 Revenue information leak

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

CVE-2026-73595

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Code execution,...

CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

The vulnerability of the microprogramming software of Reyrolle 7SR5 devices, related to the loading of code without checking its integrity, allows a perpetrator to execute arbitrary code.

The vulnerability of the microprogramming software in relay protection and automation devices from Reyrolle 7SR5 relates to the loading of code without checking its integrity. Exploiting this vulnerability can allow an intruder to execute arbitrary code...

PT-2026-102787

Name of the Vulnerable Software and Affected Versions MobilityDB versions prior to 1.3.1 Description An out-of-bounds read exists in the MEOS binary and library WKB deserialization logic. Unprivileged database users can cause a remote denial-of-service condition, crashing the PostgreSQL backend...

PT-2026-102511

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.36 Description An unauthenticated attacker with remote access can exploit a Download of Code Without Integrity Check issue. This flaw allows the system to download code without...

PT-2026-102613

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-100297: Server-Side Request Forgery (SSRF)

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries...

PT-2026-102693

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description An improper Access Control List ACL check occurs in the outputs for tagged items. This flaw allows unauthorized users to view content items that...

PT-2026-102699

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description Improper Access Control List ACL checks for various webservice edit tasks allow unauthorized users to perform edit actions on items that should...

Editor can forge file-provisioning provenance on dashboards via the dashboard API

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

PT-2026-102910

Name of the Vulnerable Software and Affected Versions KitchenAsty versions prior to 0.3.1 Description Broken object level authorization IDOR exists in the reservations API. The endpoint 'GET /api/reservations/:id' in packages/server uses authentication middleware but fails to perform ownership or...

CVE-2026-101267: Missing Authorization

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

PT-2026-102689

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description Improper Access Control List ACL checks in webservice endpoints allow unauthorized users to perform mutation actions. ACL is a mechanism used to...

PT-2026-102609

Name of the Vulnerable Software and Affected Versions lib0 versions 0.2.1 through 0.2.117 lib0 versions prior to 1.0.0-rc.33 Description A missing bounds check in the binary decoder allows an unauthenticated remote peer to read adjacent process memory. The readUint8Array function fails to compare...

PT-2026-102830

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries...

PT-2026-102692

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description An improper Access Control List ACL check in the content history comparison view allows unauthorized users to view content that should be...

Important: unbound

Issue Overview: In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones zonemd-check: yes which are located below but not at a trust anchor allow for an attack window where tampered with zone contents are served or stored to disk prior to the ZONEMD...

CVE-2026-102930: Download of Code Without Integrity Check

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...