ROS-20261013-73-0235

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-111616

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

Microsoft Windows: CVE-2026-85938: Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

CVE-2026-9268: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without...

PT-2026-112736

Name of the Vulnerable Software and Affected Versions Windows Common Log File System Driver affected versions not specified Description The Windows Common Log File System Driver contains a flaw where functionality from an untrusted control sphere is included, allowing an authorized attacker to...

ROS-20261013-73-0212

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-113341

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight enforcement in...

PT-2026-111325

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.24 Description An issue exists where incorrectly configured access control security levels allow for missing authorization, enabling unauthorized access or actions. Recommendations Update WP User Manager t...

PT-2026-112246

Name of the Vulnerable Software and Affected Versions Windows Remote Access Connection Manager affected versions not specified Description Improper access control allows an authorized attacker to locally disclose sensitive information, which can affect the system. Recommendations At the moment,...

CVE-2026-85938: Missing Authorization

Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...

ROS-20261013-73-0438

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-111634

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-15943: OIDC identity provider update reuses masked client secret after token URL changes. CVE-2026-18569: OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled. CVE-2026-82968: Persistent wrong-account linkin...

CVE-2026-108493: Missing Authorization

Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1...

CVE-2026-96855: Missing Authorization

Improper access control in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-96218: External Control of System or Configuration Setting

Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally...

CVE-2026-85355: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-83864: Authentication Bypass by Spoofing

Improper access control in Windows NTFS allows an authorized attacker to disclose information locally...

PT-2026-111179

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.6 through 19.2.7 GitLab EE versions 19.3 through 19.3.4 GitLab EE versions 19.4 through 19.4.1 Description Insufficient access control checks allow an authenticated user with limited permissions to modify project CI/CD...

CVE-2026-103965: Improper Control of Generation of Code

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return...