PT-2026-77284

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3 Description An issue exists in the TLS certificate creation process where the endpoint "/api/1/authorities" does not properly verify permissions when the type parameter is set to subca and ADMIN ONLY AUTHORITY...

PT-2026-76943

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

PT-2026-76948

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-50768

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

vuln-archive-skills

Vuln-Archive Skill A Claude Codehttps://claude.com/product...

PT-2026-73416

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-75049: Missing Authorization

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

PT-2026-76698

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

CVE-2026-19725

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...

EUVD-2026-59918

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...

CVE-2026-19725

The WPvivid — Backup, Migration & Staging WordPress plugin versions before 0.9.131 is vulnerable to an unauthenticated path traversal via the send_to_site_connect functionality. The root cause is a failure to sanitize values from an unauthenticated request used to construct a log file path. An at...

PT-2026-73126

Name of the Vulnerable Software and Affected Versions WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.131 Description An issue exists where the plugin fails to sanitize a value from an unauthenticated request used to construct a log file path. An attacker possessing a...

CVE-2026-19725: Improper Limitation of a Pathname to a Restricted Directory

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...

CVE-2026-74448

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqmcreatequeue When MES is enabled and amdgpuamdkfdallockernelmem fails during the first queue creation for a process, pqmcreatequeue returns early via 'return retval' without going through the...

CVE-2026-74273

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

UBUNTU-CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

EUVD-2026-59420

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...