CVE-2026-110454: Improper Access Control

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

ROS-20261014-73-0092

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261014-73-0023

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-113641

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device...

CVE-2026-55387: Improper Access Control

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's...

ROS-20261014-73-0184

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-110618: Missing Authentication for Critical Function

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or...

ROS-20261014-73-0129

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261014-73-0060

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-59766: Improper Access Control

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and...

PT-2026-114060

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or...

CVE-2026-102051: Missing Release of Memory after Effective Lifetime

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast...

PT-2026-114058

Name of the Vulnerable Software and Affected Versions NullHub versions prior to 2026.5.29 Description An authentication bypass exists in the management API endpoint /api/ because the auth token field defaults to null and is never assigned. Unauthenticated attackers sending requests without...

PT-2026-114138

Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp...

Linux Distros Unpatched Vulnerability : CVE-2026-86562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDU...

PT-2026-114301

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A TOCTOU Time-of-Check to Time-of-Use double-fetch of control-queue descriptors in the lib/vhost library leads to a heap buffer overflow. This occurs within the VDUSE control-queue handler, allowi...

CVE-2026-102000: Reachable Assertion

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic...

CVE-2026-110227: Missing Authorization

Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...

PT-2026-114357

Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM on-prem affected versions not specified Description An improper access control issue exists in the export settings, which could allow a remote authenticated attacker to obtain sensitive information. This...

CVE-2026-103988: Improper Access Control

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not...