PT-2026-71505

Subscriber Broken Access Control in Tourfic = 2.23.1 versions...

PT-2026-71496

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...

PT-2026-71602

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

PT-2026-71570

Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...

iscsi-initiator-utils security, bug fix, and enhancement update

6.2.1.11-1.git4b3e853.0.1.el102.2 - Validate interface IP against target address family Orabug: 39491397 - iscsi delay reconnect until interface has valid IP Orabug: 38445491 - Change the order of restart iscsi services in spec file Orabug: 37749406 - Change the loglevel of logdebug message in...

PT-2026-71518

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

PT-2026-71526

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

PT-2026-71799

Name of the Vulnerable Software and Affected Versions Signify Philips Hue Bridge Pro versions prior to 1.77.2071318010 Description The firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces with anonymous access enabled and no firewall restrictions. This allows an...

ROS-20260813-73-0037

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0030

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0033

The vulnerability in Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability can allow an attacker to cause service failures...

ROS-20260813-73-0043

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0006

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0027

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0018

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Linux operating system’s kernel, related to access control deficiencies, allows a hacker to trigger a service failure.

The vulnerability of the Linux operating system’s kernel is related to lack of access control. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-47718

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. When secureEnabled=true, FUXA 1.3.0-2773 still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue...

CVE-2026-47718

CVE-2026-47718 (FUXA) affects the FUXA web-based SCADA/HMI with secureEnabled=true. In version 1.3.0-2773 , the token handling in server/api/jwt-helper.js (verifyToken) converts missing or invalid tokens into a guest context instead of rejecting the request, allowing unauthenticated or invalid-to...