Linux kernel Infiniband verbs Data Compromise

The vulnerability in the drivers/infiniband/hw/irdma/verbs.c and drivers/infiniband/hw/irdma/verbs.h components of the Linux kernel is related to an improper implementation of a control flow. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality and availabili...

Linux kernel Infiniband verbs RCE

The vulnerability in the Linux kernel’s drivers/infiniband/hw/irdma/verbs.c component is related to insufficient resource control during its existence. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of protected information...

PT-2026-115504

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

PT-2026-115627

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

PT-2026-115591

Name of the Vulnerable Software and Affected Versions SmartCrawl versions prior to 3.16.5 Description An authorization bypass exists due to a user-controlled key, which allows the exploitation of incorrectly configured access control security levels. Recommendations Update SmartCrawl to version...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-110366: Missing Authorization

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4...

CVE-2026-106705: Improper Access Control

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-61726: Improper Access Control

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-110900: Missing Authorization

Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5...

CVE-2026-111716: Authorization Bypass Through User-Controlled Key

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

PT-2026-115879

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-131767 advisory. In the Linux kernel, the following vulnerability has been resolved: block: fix rq-qos breakage from skipping rqqosdonebio a647a524a467 block: don't call...

CVE-2026-111641: Missing Authentication for Critical Function

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...

CVE-2026-111690: Use of Hard-coded Cryptographic Key

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

CVE-2026-110287: Incorrect Authorization

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...

CVE-2026-111044: Incorrect Authorization

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

SUSE CVE-2026-86562

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker ca...