CVE-2026-110454

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

CVE-2026-110454

The UniFi Protect AI Key is affected by an Improper Access Control vulnerability (CWE-284). A malicious actor with network access could exploit this flaw to gain access to internal resources through the device. No specific details regarding the root cause, affected versions, or remediation steps ...

qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header

A flaw was found in the QtNetwork module of the Qt Framework. This out-of-bounds read vulnerability allows a remote attacker to cause a denial of service application crash. This occurs when an application using QNetworkAccessManager processes an excessively large HTTP Cache-Control header value...

Adobe ColdFusion - Access Control Bypass

There is an access control bypass vulnerability in Adobe ColdFusion versions 2023 Update 2 and below, 2021 Update 8 and below and 2018 update 18 and below, which allows a remote attacker to bypass the ColdFusion mechanisms that restrict unauthenticated external access to ColdFusion's Administrato...

CLEANSTART-2026-ZY41765 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-VA16000 Improper access control in subsystem for BlueZ before version 5

Security vulnerability affects the bluez package. Improper access control in subsystem for BlueZ before version 5...

EUVD-2026-100726

CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interactio...

EUVD-2026-100743

CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interactio...

Malware in @kre64/hello-npm-test

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-96540: Incorrect Authorization

An improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to...

CVE-2026-78433: Improper Access Control

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

CVE-2026-67577: Improper Access Control

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity...

CVE-2026-66849: Improper Access Control

Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects...

ROS-20261014-73-0176

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-113703

Name of the Vulnerable Software and Affected Versions Restricted Site Access versions prior to 7.6.3 Description A missing authorization issue in the 10up Restricted Site Access plugin allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to ...

WordPress Bus Ticket Booking with Seat Reservation authorization issue vulnerability

WordPress Bus Ticket Booking with Seat Reservation versions 5.9.7 and earlier contain an authorization issue vulnerability. This vulnerability stems from insufficient authorization checks, which may allow attackers to exploit improperly configured access control security levels...

PT-2026-114012

Name of the Vulnerable Software and Affected Versions Hestia Control Panel versions 1.9.7 through 1.10.4 Description A low-privileged authenticated user with a web domain can execute arbitrary code as root. The issue occurs because the update object value function in func/main.sh fails to escape...

PT-2026-113949

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project id from the URL. ProjectPagePermission likewise derives the caller's role from the...

PT-2026-114359

Name of the Vulnerable Software and Affected Versions NGINX Gateway Fabric affected versions not specified Description An issue exists when the software is configured with the Gateway Custom Resource Definition CRD and maintains an authenticated gRPC connection with the NGINX Agent. A namespaced...

CVE-2026-110456: Improper Access Control

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...