CVE-2026-87026: Missing Authorization

Tanium addressed an improper access controls vulnerability in Threat Response...

CVE-2026-59569

CVE-2026-59569 is an improper input validation vulnerability in Zscaler Client Connector (ZCC) on Android and ChromeOS , specifically in the VPN API method , that allows a local attacker with high privileges to potentially bypass Zscaler controls and escalate privileges. The CVSS v3.1 score is 8....

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: i2c/tw9906: A potential memory leak was fixed in tw9906probe. In one of the error paths in tw9906probe, the memory allocated in v4l2ctrlhandlerinit and v4l2ctrlnewstd is not freed. This issue was addressed by calling...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: i2c/tw9903: A potential memory leak has been fixed in tw9903probe. In one of the error paths in tw9903probe, the memory allocated in v4l2ctrlhandlerinit and v4l2ctrlnewstd is not freed. This issue has been fixed by calling...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed a NULL pointer dereference in sndusbmixercontrolsbadd In sndusbcreatestreams, for UAC version 3 devices, the Interface Association Descriptor IAD is retrieved via usbifnumtoif. If this call fails, a fallbac...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed a use-after-free in sndusbmixerfree When sndusbcreatemixer fails, sndusbmixerfree frees mixer-idelems, but the controls that were previously added to the card still reference the freed memory. Later, when...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: ov5675: Fixed a memory leak in ov5675initcontrols There is a memory leak when testing the media/i2c/ov5675.c file using bpf mock. Device: AssertionError: Unreferenced object 0xffff888107362160 size 16: comm "python3", pid...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fixed the bounds check for sx controls. For sx controls, the semantics of the max field are not the usual one; max represents the number of steps, rather than the maximum value. This means that our check in...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for the second channel in sndsocputvolswsx The bounds checks in sndsocputvolswsx are only applied to the first channel. This means that it is possible to write out-of-bounds values to the second channel in...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in 389-ds-base. The getldapmessagecontrolsext function in the LDAP server does not enforce an upper limit on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal...

PT-2026-91247

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector on Android and ChromeOS affected versions not specified Description An improper input validation issue exists in Zscaler Client Connector on Android and ChromeOS. This flaw allows an attacker to potentially bypass...

CVE-2026-59569: Improper Input Validation

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...

EUVD-2026-77039

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

EUVD-2026-76980

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-90493

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet...

CVE-2026-90493 Tonec Internet Download Manager Kernel Driver idmwfp.sys access control

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet...

PT-2026-90783

Name of the Vulnerable Software and Affected Versions Tonec Internet Download Manager versions prior to 6.42 Build 64 Description An improper access control issue exists in the idmwfp.sys kernel driver of Tonec Internet Download Manager on Windows. The driver exposes the .IDMWFP device interface ...

PT-2026-90870

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

CVE-2026-90546: Missing Authorization

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to record likes on password-protected and group-restricted videos. Attackers can submit like requests for videos they cannot watch...

UBUNTU-CVE-2026-89736

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix use-after-free on sound card disconnect gaudiocleanup invokes sndcardfreewhenclosed to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However,...