ROS-20261028-73-0022

The vulnerability in the Visual Studio Code source code editor is related to access control flaws. Exploiting this vulnerability could allow an attacker to escalate their privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-118337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...

CVE-2026-118804: Bricks Bricks Builder: Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to…

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

PT-2026-130596

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle"...

PT-2026-130571

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them. The module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is onl...

PT-2026-130586

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. The module doesn't sufficiently check access on the form to resend receipts. Under certain configurations, this allows some users to gain access to receipts and customer...

WordPress Optima Express IDX authorization issue vulnerability

WordPress Optima Express IDX versions 9.0.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, enabling exploitation of improperly configured access control security levels...

Benjamin Larsson rtl_433 buffer error vulnerability

In RTL433 versions 21.12 through 25.12, there is a buffer error vulnerability stemming from a stack buffer overflow in the proflame2mc function. Sending more than seven valid Manchester encoding bytes can cause the stack buffer to be overwritten beyond its 7-byte limit. Attackers can exploit this...

PT-2026-129193

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

This module allows for direct viewing of a file with the URL alias. This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can...

PT-2026-128185

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores first cb, last cb and bytes sent in the skb control block and reads them back on completion to free the skb and credit BQL. ether setup leaves IFF TX...

CVE-2026-118247: Improperly Controlled Modification of Object Prototype Attributes

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting proto or constructor. DataTable.setCell, including Dashboards connect...

CVE-2013-20007: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to…

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timerinterval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and ru...

PT-2026-128268

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/id allow an authenticated user with any privileges to view the status and metadata of any layout, including...

PT-2026-129094

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting proto or constructor. DataTable.setCell, including Dashboards connect...

CVE-2026-67073: HCL Software BigFix AEX: HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized acces...

Linksys WAG200G command injection vulnerability

The Linksys WAG200G versions 1.01.06 and earlier contain a command injection vulnerability. This vulnerability arises from OS command injection via the timerinterval parameter. Attackers can send specially crafted POST requests to setup.cgi to launch telnetd or download and execute backdoors,...

PT-2026-129164

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

PT-2026-128246

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...

PT-2026-128210

Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3...