CVE-2026-107036

The application Mission Control / AIMSICD (version 2026080501 ) is vulnerable to unauthorized access due to insecure permissions . This flaw allows an attacker to invoke an exported component , which directly impacts the application's tracker blocker mechanism . No specific remediation or exploit...

CVE-2026-107040

The MBasov OMN-Go software (version 26080824 ) contains a vulnerability caused by insecure permissions . This flaw allows an unauthorized attacker to invoke an exported component, which can lead to arbitrary data access and the ability to control data flow . No specific remediation details, explo...

CVE-2026-107032

Insecure permissions in Bulk Share : Location Sender v2.1.0 versionCode 5 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...

CVE-2026-90867: Progress Software WS_FTP Server: Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...

CVE-2026-51902

SuperAGI (up to v0.0.14 ) contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} fails to verify if the project belongs to the authenticated user's organization. This allows authenticated users to retrieve a complete list of agents be...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve N...

Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS

The version of Symfony and/or the Symfony HTTP Foundation Component installed on the remote host is 4.1.0 or later prior to 5.4.54, or 6.0.0 or later prior to 6.4.46, or 7.0.x prior to 7.4.19, or 8.0.x prior to 8.1.7. It is, therefore, affected by a denial of service vulnerability. -...

Tanium Comply 2.32.x < 2.32.263 / 2.35.x < 2.35.323 / 2.37.x < 2.37.326 Improper Access Control (TAN-2026-073)

The version of Tanium Comply installed on the remote host is 2.32.x prior to 2.32.263, 2.35.x prior to 2.35.323, or 2.37.x prior to 2.37.326. It is, therefore, affected by an improper access controls vulnerability as referenced in the TAN-2026-073 advisory. - Tanium addressed an improper access...

Malware in b20miner

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-118804

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

CVE-2026-118690

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

octopus

Octopus Huge thanks to QuoScient for having sponsored this project. Octopus is a security analysis framework for WebAssembly module and Blockchain Smart Contract. The purpose of Octopus is to provide an easy way to analyze closed-source WebAssembly module and smart contracts bytecode to understan...

CVE-2026-118804

Bricks Builder version 2.4.3 and earlier is vulnerable to a broken access control flaw. Unauthenticated attackers can exploit the POST /wp-json/bricks/v1/query_result REST endpoint by providing a publicly obtainable nonce and crafted post_status and post_type values within the originalQueryVars p...

CVE-2026-118804 Bricks Broken Access Control via query_result Endpoint

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2026-118690

The Signal K Server version before 2.33.0 is vulnerable to a missing authentication flaw in the /skServer/ziplogs endpoint. This vulnerability allows unauthenticated remote attackers to download log archives containing a security.json file. By extracting the JWT secretKey from this file, an attac...

Malicious code in @zaip-ai/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e44ea3cafd9835a85d3305b6aa9ed2f5400546938c6430c19a30cbdc5398936 @zaip-ai/[email protected] is a CLI package whose shipped files trigger keyword co-occurrence patterns curl/wget/ping tokens, Buffer.from base64 decoding...

Malware in @zaip-ai/cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-6647

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...