EUVD-2026-56178

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to...

CVE-2026-18636 Velociraptor VFSGetBuffer API path deny list bypass

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to...

CVE-2026-18636

The CVE affects Velociraptor’s gRPC API (VFSGetBuffer) where a path-prefix denial check can be bypassed, enabling a user with ROOT read permission to access files in other orgs. The CVSS metrics indicate a NETWORK exploit with LOW complexity and HIGH confidentiality impact, requiring HIGH privile...

CVE-2026-18636 Velociraptor VFSGetBuffer API path deny list bypass

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to...

CVE-2026-72922 AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogptplatform/backend/backend/api/features/integrations/router.py webhookingressgeneric route selected getwebhookmanagerprovider from the untrust...

CVE-2026-18127

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...

CVE-2026-18127

CVE-2026-18127 affects Ivanti Endpoint Manager core prior to 2024 SU7. An authenticated, network-accessible attacker can externally control a filename in the Core, enabling full write access to an S3 bucket used for session-recording storage. The CVSS score is 7.7 (HIGH); attack requires low priv...

EUVD-2026-56157

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...

Windows Kernel Elevation of Privilege Vulnerability

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally...

.NET Information Disclosure Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network...

Visual Studio Code Python Extension Security Feature Bypass Vulnerability

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally...

Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally...

Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability

Insufficient granularity of access control in User-Mode Power Service UMPS allows an authorized attacker to elevate privileges locally...

CVE-2026-72778

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72601

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72600

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72563

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the LeadsController@update endpoint. The endpoint performs no authorization check, and the Lead model has guarded set to an empty array...

CVE-2026-72595

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

CVE-2026-72561

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before...

CVE-2026-72596

A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...