Linksys WAG200G command injection vulnerability

The Linksys WAG200G versions 1.01.06 and earlier contain a command injection vulnerability. This vulnerability arises from OS command injection via the timerinterval parameter. Attackers can send specially crafted POST requests to setup.cgi to launch telnetd or download and execute backdoors,...

PT-2026-129164

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

PT-2026-128246

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...

PT-2026-128210

Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3...

Linux Distros Unpatched Vulnerability : CVE-2026-117609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc that allows nearby attackers to write past a 7-byte stack buffer by...

n8n permission and access control issue vulnerability

Versions prior to n8n 2.41.5 and versions 2.42.x prior to 2.42.2 contain a permission and access control vulnerability. This vulnerability arises because the full execution context of failed workflows—including the identity of the user running them—is passed to a misconfigured workflow. Project...

CVE-2026-116393: iHomefinder, Inc. Optima Express: Missing Authorization vulnerability in iHomefinder, Inc

Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0...

Vulnerability related to permission and access control issues in Juniper Networks Session Smart Conductor

Versions prior to Juniper Networks Session Smart Conductor 7.0.5, versions 7.1.0 through 7.1.7, and versions 7.2.0 through 7.2.3 contain a privilege escalation and access control vulnerability. This vulnerability stems from improper permission allocation for critical resources within...

WSO2 API Manager cross-site scripting vulnerability

Versions 3.2.0 through 3.2.0.480, 3.2.1 through 3.2.1.99, 4.1.0 through 4.1.0.265, 4.2.0 through 4.2.0.205, 4.3.0 through 4.3.0.117, 4.4.0 through 4.4.0.80, 4.5.0 through 4.5.0.65, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.1 of WSO2 API Manager; versions 4.5.0 through 4.5.0.66, 4.6.0 throug...

CVE-2026-117609: merbanan rtl_433: rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby…

rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to...

WordPress BeyondSEO permission and access control issue vulnerability

WordPress BeyondSEO versions 1.3.6 and earlier contain a permission and access control vulnerability. This issue arises because the plugin permanently grants module capabilities such as “rankingcoachwriteredirectManager” to the Contributor role via BaseModule::defineCapabilities. Additionally, th...

GFI KerioConnect permission and access control issue vulnerability

Versions prior to GFI KerioConnect Outlook Connector Offline Edition 10.0.9 Patch 2 contain a vulnerability related to permission and access control issues. This vulnerability stems from insufficient permissions in the installer, allowing the product directory to be written to by the built-in Use...

CVE-2013-20008: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the…

Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate...

PT-2026-129130

An access control bypass flaw was found in Samba's vfs ceph rgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs ceph rgw module. When a client requests an existing file using...

CVE-2025-14260: WSO2: Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to…

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network...

PT-2026-127794

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and r...

PT-2026-128225

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized acces...

PT-2026-129205

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post status and post type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query result REST endpoin...

Linksys WAG200G authorization issue vulnerability

The Linksys WAG200G versions 1.01.06 and earlier contain an authorization issue vulnerability. This vulnerability stems from a weak password change mechanism, allowing attackers to change administrator passwords without providing the current password. As a result, authenticated administrators may...

Highcharts cross-site scripting vulnerability

Highcharts versions 1.0.0 through 4.2.2 contain a cross-site scripting vulnerability. This stems from unvalidated searches of the chartConstructor property, which may allow attackers to copy malicious options into container properties or features via control panel configuration. When these are...