Linux nfsd4 DropRevokedStid() DoS

The vulnerability of the nfsd4 DropRevokedStid function in the fs/nfsd/nfs4state.c component of the Linux operating system is related to insufficient resource control with dynamic management. Exploiting this vulnerability could allow a remote attacker to cause service failures...

Linux kernel sch_codel DoS

The vulnerability in the net/sched/schcodel.c component of the Linux kernel is related to an improper implementation of a control flow. Exploitation of this vulnerability enables a remote attacker to compromise the confidentiality, integrity, and availability of protected information...

Linux kernel BPF Insecure Compromise

The vulnerability in the kernel/bpf/inode.c component of the Linux operating system is related to an improper implementation of a control flow. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of protected information...

Linux kernel RAID10 Buffer Overflow DoS

The vulnerability in the drivers/md/raid10.c component of the Linux kernel is related to an improper implementation of a control flow. Exploitation of this vulnerability enables a remote attacker to compromise the confidentiality, integrity, and availability of protected information...

PT-2026-116075

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-106705

The ELADMIN (eladmin-mp) framework, up to version 2.7 , is susceptible to an improper access control vulnerability within the role management module. Specifically, the PUT /api/roles/menu (RoleController.updateRoleMenu) endpoint fails to validate the granted menu set and does not prevent a caller...

PT-2026-115606

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.3.8.1 Description Improper access control regarding asset contact passwords allows an authenticated user who possesses general Edit permissions but lacks specific Edit asset permissions to modify the...

PT-2026-115593

Name of the Vulnerable Software and Affected Versions Advanced Post Manager versions prior to 4.5.7 Description Missing authorization allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version 4.5.7 or later...

PT-2026-116115

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can access document. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

PT-2026-116040

Name of the Vulnerable Software and Affected Versions FastapiAdmin versions prior to 3.1 Description An authentication bypass allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via the...

PT-2026-116089

Name of the Vulnerable Software and Affected Versions Simple Admin Core versions prior to 1.8.8 Description An authentication bypass exists due to a hard-coded Auth.AccessSecret located in the api/etc/core.yaml file. This allows unauthenticated remote attackers to forge JSON Web Tokens JWT by...

PT-2026-115598

Name of the Vulnerable Software and Affected Versions YITH PayPal Express Checkout for WooCommerce versions prior to 1.61.0 Description A missing authorization issue exists due to incorrectly configured access control security levels. Recommendations Update YITH PayPal Express Checkout for...

PT-2026-115630

Name of the Vulnerable Software and Affected Versions libp2p-rust versions prior to 0.49.5 Description In the official Rust implementation of the libp2p networking stack, the handling of Gossipsub GRAFT control messages allows the addition of attacker-supplied topic hashes to connected peer.topic...

CVE-2026-110901: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4...

MAL-2026-17923 Malicious code in @apexacc/audit (npm)

@apexacc/audit is the companion package to @apexacc/cli in the "Apex Accelerator" campaign Elastic Security Labs REF8801, 2026-10-12. It exposes an MCP server with 18 "security tools" that all return fabricated output for example a fixed Slither report and a "NOT A HONEYPOT" verdict, registers...

CVE-2026-95859: Allocation of Resources Without Limits or Throttling

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connectedpeer.topics without confirming that the peer previously subscribed to those topics. A...

EUVD-2026-102904

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

Linux Watchdog DoS

The vulnerability in the watchdogunregisterdevice function within the drivers/watchdog/watchdogcore.c component of the Linux kernel operating system is related to improper thread management. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Linux kernel Control Flow

The vulnerability of the Linux operating system’s kernel is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux driver/infiniband/sw/rxe/rxe_resp.c Data Compromise

The vulnerability of the drivers/infiniband/sw/rxe/rxeresp.c component of the Linux operating system’s kernel is related to insufficient control of resources during its existence. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...