CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

PT-2026-96260

Name of the Vulnerable Software and Affected Versions x-ui version 0.3.2 Description An improper access control issue allows any authenticated panel user to modify the xray configuration template via the settings interface. By triggering a panel restart, the xray management gRPC service Google...

vm2 require.external Code Execution

The vulnerability of the require.external component in the vm2 package manager NPM is related to insufficient control over resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Cisco IOS XR Software Security Hardening Release: September 2026 (cisco-sa-hardening-iosxr-qg64NcM)

According to its self-reported version, Cisco IOS XR is affected by multiple vulnerabilities. - Multiple vulnerabilities in Cisco IOS XR Software due to improper resource control issues could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service conditio...

EUVD-2026-84205

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

PT-2026-96210

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description The software fails to validate object ownership across multiple resource types. Authenticated users can read, modify, and delete business objects belonging to other users by submitting direct object...

CVE-2026-91164: Improper Access Control

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

ROS-20260921-73-0050

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-114751

Уязвимость конфигурации ldap-authorization и ad-authorization системы сетевого мониторинга LibreNMS связана с непринятием мер по нейтрализации специальных элементов в запросе LDAP. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить полный контроль над системой...

CVE-2026-55870: Exposure of Sensitive Information to an Unauthorized Actor

GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...

ROS-20260921-73-0038

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260921-73-0026

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-79319

Stencil core 4.43.5 is identified as vulnerable to Incorrect Access Control . The vulnerability type is confirmed across NVD and CVE List entries, but no further technical details—such as the specific affected component, root cause, impact scope, or a patched version—are provided in the current d...

Linux Distros Unpatched Vulnerability : CVE-2026-93565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming...

CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

CVE-2026-94572: Improper Control of Generation of Code

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

ROS-20260921-73-0024

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260921-73-0029

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260921-73-0023

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

container management system instancesPost disclosure

The vulnerability of the instancesPost function in the cmd/incusd/instancespost.go file of the container management system and the Incus virtual machine manager is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...