EUVD-2026-85821

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78310

The software DIAEnergie (versions before 1.11.00.022 ) is vulnerable to an Authorization Bypass caused by a user-controlled key . While the specific technical root cause and component are not detailed in the provided documents, the vulnerability allows for unauthorized access. No specific exploit...

buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability

A flaw was found in BuildKit. A custom client with valid permissions to access the BuildKit control API can produce an upload request that allows files to escape from the BuildKit-controlled state directory. This could lead to unauthorized modification or disclosure of sensitive data...

CVE-2026-78310: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-93791

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: add a check on the tid coming from the firmware banotif-tid is a firmware-controlled u8 that is used directly as an array index into tiddata without any validation. Add a bounds check against IWLMAXTIDCOUNT...

PT-2026-97731

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description An authorization bypass exists due to the use of a user-controlled key. Recommendations Update to version 1.11.00.022 or later...

CVE-2026-84691 Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an administrator

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

EUVD-2026-44813

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding...

CVE-2026-87074 Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

WordPress Forminator Forms plugin 1.17.1-1.57.2.0 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link vulnerability

Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link vulnerability discovered by vuxvinh in WordPress Plugin Forminator versions 1.17.1-1.57.2.0...

EUVD-2026-84955

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input...

CVE-2026-95602: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

CVE-2026-61834: Improperly Controlled Modification of Dynamically-Determined Object Attributes

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

PT-2026-97490

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

CVE-2026-18162

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to execute arbitrary code . The root cause is the improper neutralization of user-controlled input within the new Function constructor . The vulnerability has a CRITI...

DEBIAN-CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-18461

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...

CVE-2026-18461 Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...

CVE-2026-18461

The RTI Connext Professional (Core Libraries) is vulnerable to a Format String Injection flaw due to the Use of Externally-Controlled Format String . This vulnerability affects versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.3.1.6 . An attacker could potentially exploit this to impact the con...

EUVD-2026-84616

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...