CVE-2026-110737

The push endpoint in Vaadin applications using server push is vulnerable to a cross-origin request forgery (CSRF) style attack. Because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false, the CorsInterceptor echoes the request's Origin into the Access-Control-All...

CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

EUVD-2026-110721

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...

WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 0xdr3n in WordPress Plugin GEO my WordPress versions = 4.5.5.5...

WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin HANDMADE – Dropshipping for Etsy and WooCommerce versions = 1.0.10...

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by MinKhoy - VinSOC in WordPress Plugin LearnPress versions = 4.4.11...

WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Broadcast Live Video versions = 7.3.9...

Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate ASD says. The agency's operators gained access to the criminal's operation's backend and cut it off from those...

Exploit for Insufficient Granularity of Access Control in Microsoft

CVE-2026-33825 Proof of Concept / Exploit archive per CVE-2...

CVE-2026-99052

A flaw was found in the Linux kernel. When a Network File System version 4 NFSv4 share configured with security labels is mounted multiple times, the Security-Enhanced Linux SELinux subsystem fails to preserve native labeling flags on the reused filesystem. This flaw allows a local user to silent...

Updated evolution package fixes a security vulnerability

Javascript execution via spoofed vcard control bypasses mail script-markup restriction. CVE-2026-88859...

MGASA-2026-0554 Updated evolution package fixes a security vulnerability

Javascript execution via spoofed vcard control bypasses mail script-markup restriction. CVE-2026-88859...

ciberaplicada-uc2

Exposición y mitigación de vulnerabilidades críticas Cibers...

CLEANSTART-2026-TS76124 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

PT-2026-126409

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects :...

PT-2026-126441

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Process Control vulnerability. A high...

Grafana proxy server Data Read Modify Delete

The proxy server vulnerability in the Grafana monitoring and observability platform is related to access control flaws. Exploitation of this vulnerability may allow a remote attacker to gain read, modify, or delete data...

PT-2026-126620

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client versions prior to 15.83 TeamViewer Portable versions prior to 15.83 TeamViewer Remote Control App versions prior to 15.83 Description An integer overflow exists in the remote-control screen processing component,...

PT-2026-126623

An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root...

PT-2026-126640

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only Device Monitor privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel...