CVE-2026-34948

Combodo iTop versions prior to 3.2.3 are affected by an access control bypass in its OQL (Object Query Language) engine. The root cause is that the silos access check only applies to classes present in the SELECT clause , leaving classes referenced via JOINs unprotected. This allows an authentica...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.jsL1686-L1705 This was fixed wi...

CVE-2026-77413 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

CVE-2026-62283

Nezha Monitoring (a self-hostable server and website monitoring tool) versions 1.14.13–1.14.14 and 2.0.0–2.0.9 contain a cross-tenant session hijack vulnerability. Stream identifiers created by CreateStream in service/rpc/io_stream.go are not bound to their creating user, and the WebSocket endpoi...

CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

CVE-2026-67360

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-26081

A flaw was found in HAProxy. This vulnerability, stemming from a missing length check in the NEWTOKEN format, could allow a remote attacker to cause a low impact on data integrity and availability. This means an attacker might be able to subtly alter data or temporarily disrupt the service...

CVE-2026-67360 Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

EUVD-2026-64059

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-67360 Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-58254

A flaw was found in NATS Server. Message trace destination checks, which ensure that trace events are sent to authorized subjects, were not consistently applied to messages originating from leafnode connections. This inconsistency allows a leafnode operator to bypass these checks and send trace...

CVE-2026-77235 Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel

Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to...

nginx-rift-check

nginx-rift-check Trova configurazioni vulnerabili a CVE-2026-42945 , l'heap buffer overflow nel ngxhttprewritemodule di nginx. Eseguire una versione di nginx affetta dalla 0.6.27 alla 1.30.0 non basta perché la vulnerabilità sia sfruttabile. La configurazione deve contenere una coppia specifica d...

CVE-2026-49114

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-77759

Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 contain an IDOR vulnerability in the transaction API. The endpoint GET /api/transaction/{id} resolves transaction identifiers without company scoping or any permission check, allowing an authenticated user to enumerate and read financial trans...

EUVD-2026-63906

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

CVE-2026-66797

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...