CVE-2026-73318

XenForo versions before 2.3.13 contain a missing authorization flaw in the force-agreement controller . Any ACP administrator can access and submit force-agreement forms regardless of their assigned permissions, bypassing the option permission declared in the navigation configuration. This allows...

CVE-2026-73318 XenForo < 2.3.13 Missing Authorization via force-agreement Controller

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation...

CVE-2026-81531: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

PT-2026-87579

Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...

PT-2026-87337

Name of the Vulnerable Software and Affected Versions Windows Storage Spaces Controller affected versions not specified Description A stack-based buffer overflow occurs in the Windows Storage Spaces Controller. This issue allows an authorized attacker to elevate privileges locally on the system. ...

PT-2026-87186

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

PT-2026-87185

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-68844: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally...

CVE-2026-69290: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...

PT-2026-87573

Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to disclose information locally...

PT-2026-87281

Name of the Vulnerable Software and Affected Versions Windows Storage Spaces Controller affected versions not specified Description A heap-based buffer overflow exists in the Windows Storage Spaces Controller. This issue allows an authorized low-privilege attacker to execute arbitrary code locall...

PT-2026-87063

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A missing authorization issue exists in the force-agreement controller. This allows any ACP administrator to access and submit force-agreement forms, bypassing the assigned permissions and the optio...

CVE-2026-68877: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally...

PT-2026-87294

Name of the Vulnerable Software and Affected Versions Windows Storage Spaces Controller affected versions not specified Description A heap-based buffer overflow occurs in the Windows Storage Spaces Controller. This issue allows an authorized attacker to execute arbitrary code locally or remotely,...

CVE-2026-69568: Out-of-bounds Read

Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to disclose information locally...

PT-2026-88501

Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...

CVE-2026-69575: Use After Free

Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

PT-2026-88457

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86285

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...