Dell PowerProtect Data Domain authorization issue vulnerability

Versions 7.7.1.0 through 8.8 of Dell PowerProtect Data Domain, versions 7.13.1.0 through 7.13.1.80 of LTS2024, versions 8.3.1.0 through 8.3.1.40 of LTS2025, and versions 8.6.1.0 through 8.6.1.20 of LTS2026 contain an authorization issue vulnerability. This vulnerability stems from improper...

Linux Distros Unpatched Vulnerability : CVE-2026-118337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...

WSO2 API Manager server request forgery vulnerability

Versions 3.1.0 through 3.1.0.354, 3.2.0 through 3.2.0.458, 3.2.1 through 3.2.1.99, 4.0.0 through 4.0.0.379, 4.1.0 through 4.1.0.265, 4.2.0 through 4.2.0.205, 4.3.0 through 4.3.0.115, and 4.4.0 through 4.4.0.79 of WSO2 API Manager contain a server-side request forgery vulnerability. This...

PT-2026-128244

Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0...

CVE-2026-118804: Bricks Bricks Builder: Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to…

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

PT-2026-127733

rtl 433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2 mc that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to...

PT-2026-130596

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle"...

PT-2026-130571

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them. The module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is onl...

PT-2026-130586

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. The module doesn't sufficiently check access on the form to resend receipts. Under certain configurations, this allows some users to gain access to receipts and customer...

WordPress Optima Express IDX authorization issue vulnerability

WordPress Optima Express IDX versions 9.0.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, enabling exploitation of improperly configured access control security levels...

WordPress BeyondSEO permission and access control issue vulnerability

WordPress BeyondSEO versions 1.3.6 and earlier contain a permission and access control vulnerability. This issue arises because the plugin permanently grants module capabilities such as “rankingcoachwriteredirectManager” to the Contributor role via BaseModule::defineCapabilities. Additionally, th...

Benjamin Larsson rtl_433 buffer error vulnerability

In RTL433 versions 21.12 through 25.12, there is a buffer error vulnerability stemming from a stack buffer overflow in the proflame2mc function. Sending more than seven valid Manchester encoding bytes can cause the stack buffer to be overwritten beyond its 7-byte limit. Attackers can exploit this...

GFI KerioConnect permission and access control issue vulnerability

Versions prior to GFI KerioConnect Outlook Connector Offline Edition 10.0.9 Patch 2 contain a vulnerability related to permission and access control issues. This vulnerability stems from insufficient permissions in the installer, allowing the product directory to be written to by the built-in Use...

WSO2 API Manager cross-site scripting vulnerability

Versions 3.2.0 through 3.2.0.480, 3.2.1 through 3.2.1.99, 4.1.0 through 4.1.0.265, 4.2.0 through 4.2.0.205, 4.3.0 through 4.3.0.117, 4.4.0 through 4.4.0.80, 4.5.0 through 4.5.0.65, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.1 of WSO2 API Manager; versions 4.5.0 through 4.5.0.66, 4.6.0 throug...

Vulnerability related to permission and access control issues in Juniper Networks Session Smart Conductor

Versions prior to Juniper Networks Session Smart Conductor 7.0.5, versions 7.1.0 through 7.1.7, and versions 7.2.0 through 7.2.3 contain a privilege escalation and access control vulnerability. This vulnerability stems from improper permission allocation for critical resources within...

PT-2026-129193

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

This module allows for direct viewing of a file with the URL alias. This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can...

PT-2026-128185

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores first cb, last cb and bytes sent in the skb control block and reads them back on completion to free the skb and credit BQL. ether setup leaves IFF TX...

CVE-2026-116393: iHomefinder, Inc. Optima Express: Missing Authorization vulnerability in iHomefinder, Inc

Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0...

CVE-2026-118247: Improperly Controlled Modification of Object Prototype Attributes

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting proto or constructor. DataTable.setCell, including Dashboards connect...