CVE-2026-15952 Improper Permission Assignment in Scheduler Service

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...

EUVD-2026-88248

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...

CVE-2026-98114

A flaw was found in the Linux kernel's ksmbd server. The Discretionary Access Control List DACL parsing logic silently ignores errors caused by truncated access control entries and memory allocation failures, allowing the system to continue with an incomplete permission conversion. A remote...

EUVD-2026-88237

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to an insufficient access control flaw in the HA failover endpoint . This vulnerability allows an attacker to perform destructive PostgreSQL database operations , potentially leading to complete data destruction. The vulnerabil...

CVE-2026-82932

The mH-DEVELOPER smart home module contains a security flaw where it fails to load any firewall rules at startup. This configuration oversight leaves all listening services, such as SSH , HTTP , WebSocket , and Node-RED , fully exposed on the local area network (LAN) without any access control. C...

CVE-2026-82932 Missing Firewall Configuration in mH-DEVELOPER

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

EUVD-2026-88231

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

CVE-2026-95832

A flaw was found in kitty. This vulnerability allows an application writing output to the terminal to execute arbitrary commands in the user's shell. The issue occurs because the color control escape code handler echoes unrecognized field names back into the terminal's input stream without adequa...

CVE-2026-93265

A flaw was found in the Linux kernel's TC9563 power control driver. When parsing device tree nodes for the integrated Ethernet endpoint during device initialization, the driver improperly processes multiple functions, causing an out-of-bounds array access. A local attacker capable of supplying or...

CVE-2026-101054 Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function getfile of the file /tmp/wpasupplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available...

CVE-2026-101054

A vulnerability exists in the Thinkware U3000 (versions up to 1.02.04 ) within the TCP Service component. The flaw is located in the get_file function of the /tmp/wpa_supplicant.conf file, where improper access controls allow for remote exploitation. This vulnerability can lead to unauthorized ac...

CVE-2026-101053 Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

CVE-2026-101053

The Thinkware U3000 (up to version 1.02.04 ) contains a vulnerability in the TCP Service component. Specifically, the PUT_FILE function involving the file /tmp/wpa_supplicant.conf is susceptible to improper access controls when an attacker manipulates the argument path . This flaw can be exploite...

CVE-2026-101053 Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

WordPress Groups – Memberships and Access Control plugin <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Groups versions = 4.6.0...

WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aydan Arabadzha in WordPress Plugin MakeCommerce for WooCommerce versions = 4.1.0...

WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by c4st1e in WordPress Plugin WordPress Backup & Migration versions = 1.6.0...