PT-2026-127199

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document...

Google Chrome Vulnerability: CVE-2026-118318

Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-99018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp...

PT-2026-126618

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can pla...

PT-2026-126625

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a...

Google Chrome Vulnerability: CVE-2026-118337

Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

PT-2026-126413

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional guests field when guests are disallowed. Attackers can set additional guests to the remaining seat count in modules/events/events...

PT-2026-126422

MrDoc through 1.1.1 contains a broken access control vulnerability in the manage doc share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ...

PT-2026-126330

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP ACCESS CONTROL ALLOW ORIGIN HEADER set to false and its CorsInterceptor then echoes...

PT-2026-126364

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content slice status and...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-hardening-ise-XU5EwX5T)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a...

PT-2026-126621

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client for Linux and macOS versions prior to 15.83 Description An out-of-bounds write issue exists in the screen-image decoder. This occurs due to missing destination bounds checking in the decoder, which allows crafted...

PT-2026-125893

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session...

ROS-20261027-73-0007

The vulnerability in the sshd service of the OpenSSH cryptographic suite is related to access control flaws in certain functions. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Mozilla Firefox permission and access control issue vulnerability

Versions prior to Mozilla Firefox 159 and Thunderbird 159 contain a permission escalation and access control vulnerability stemming from an issue in the Navigation component of DOM...

Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Versions 7.7.1.0 through 8.7 of Dell PowerProtect Data Domain, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20 contain a privilege escalation vulnerability related to permission management and access control. Th...

Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Vulnerabilities related to permission and access control exist in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper access control and can be exploited by...

PT-2026-126395

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An...

BMC Control-M/Enterprise Manager authorization issue vulnerability

Versions 9.0.20 through 9.0.22 of BMC Control-M/Enterprise Manager, as well as any earlier unsupported versions, and versions 9.0.20 through 9.0.22 of BMC Control-M/Server, along with any earlier unsupported versions, contain an authorization issue vulnerability. This vulnerability stems from...

WEASEL

WEASEL: A Stealthy DNS Beacon WEASEL is a small in-memory implant using Python 3 with no dependencies. The beacon client sends a small amount of identifying information about its host to a DNS zone you control. WEASEL server can task clients to execute pre-baked or arbitrary commands. WEASEL is a...