CVE-2026-1907: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

CVE-2026-109362: Insufficient Session Expiration

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or...

CVE-2026-107432: Missing Authorization

Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1...

CVE-2026-81856: Improper Neutralization of Escape, Meta, or Control Sequences

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentati...

CVE-2026-84360: Authentication Bypass Using an Alternate Path or Channel

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

Cisco Meraki

The vulnerability of Cisco Meraki network device software relates to the implementation of incorrect control flow. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...

Linux kernel max3421_hub_control() function Heap Buffer Overflow

The vulnerability of the max3421hubcontrol function in the drivers/usb/host/max3421-hcd.c file of the Linux kernel is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...

Linux PCI ROM Buffer Overflow DoS

The vulnerability of the drivers/pci/rom.c component of the Linux operating system’s kernel is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the protected information...

Cisco Meraki Access Control

The vulnerability of Cisco Meraki network device software relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

Linux drivers mailbox mtk-adsp-mailbox Heap Buffer Overflow DoS

The vulnerability in the drivers/mailbox/mtk-adsp-mailbox.c component of the Linux kernel is related to an improper implementation of a control flow. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of protected information...

Linux kcm_attach() Heap Buffer Overflow

The vulnerability of the kcmattach function in the net/kcm/kcmsock.c component of the Linux operating system’s kernel is related to the improper implementation of the control flow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...

CVE-2026-21139: Undefined Security Weakness

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...

PT-2026-110445

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information...

PT-2026-110467

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...

PT-2026-110554

Name of the Vulnerable Software and Affected Versions Yungengxin Cloud Billing version 2024.11.28.11 Description A flaw exists in the IOCTL Process Termination component within the LWBilling64.sys library. Specifically, the sub 14000443C function is susceptible to manipulation of the Pid argument...

PT-2026-110821

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0...

CVE-2026-109307: Improper Neutralization of Input During Web Page Generation

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

PT-2026-110506

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22...

ROS-20261012-73-0149

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-109675: Authorization Bypass Through User-Controlled Key

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...