Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

Windows Mobile Device Management Tampering Vulnerability

Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally...

Windows NTFS Information Disclosure Vulnerability

Improper access control in Windows NTFS allows an authorized attacker to disclose information locally...

Windows Bind Filter Driver Elevation of Privilege Vulnerability

Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally...

Security Bulletin: Spring Expression Language (SpEL) in IBM Sterling Control Center makes it vulnerable to Improper Control of Dynamically-Managed Code Resources (CVE-2026-59283)

Summary A Critical vulnerability in Spring Framework that allows a safety guard bypass when evaluating Spring Expression Language SpEL expressions using SimpleEvaluationContext with the expression compiler enabled, potentially leading to unauthorized actions or remote code execution; affected...

CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

EUVD-2026-98663

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109959

EspoCRM versions 4.0.0 before 10.0.7 are vulnerable to an access control flaw. Authenticated users with stream access to a parent record can bypass the NoteAccessControl filter by requesting GET /Note/{id}. This allows them to read audited field values restricted by field-level security , specifi...

CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109959

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

EUVD-2026-98662

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-109958

EspoCRM version 4.0.0 before 10.0.7 is vulnerable to an improper access control vulnerability. Authenticated users with record access can bypass field-level restrictions to read restricted emailAddress values via the address-book search API . This occurs even when specific Roles are configured to...

CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-90060

A flaw was found in the Linux kernel's ALSA control module. A local user could create a write-only kcontrol element without a get callback. This could lead to a null pointer dereference in the LED layer, causing a system crash and resulting in a denial of service...

CVE-2026-90132

A flaw was found in the Linux kernel's NTFS filesystem. This vulnerability allows an unprivileged local user to bypass intended access controls by modifying reserved extended attributes xattrs, such as $LXUID, $LXGID, $LXMOD, and $LXDEV, through the setxattr function. This unauthorized modificati...

CVE-2026-90099

A flaw was found in the Linux kernel's network scheduler. An unprivileged user can exploit a memory accounting vulnerability in the traffic control tc classifier. By creating a large number of filters, an attacker can cause the kernel to pin memory outside of memory cgroup memcg limits, leading t...

CVE-2026-90081

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS component. This vulnerability occurs due to a synchronization issue in the congestion control mechanism. A remote attacker could exploit this by causing a sender to become indefinitely blocked on a congested port, leading to a...