CVE-2026-72554 Ladybird Web Solution Faveo Helpdesk - Broken Access Control

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...

CVE-2026-72548

OpenSignLabs OpenSign (up to version 2.37.0) contains an information disclosure vulnerability in the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication/authorization checks, enabling unauthenticated remote attackers...

CVE-2026-72548 OpenSignLabs OpenSign - Information Disclosure

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without...

CVE-2026-19424

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

EUVD-2026-55925

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

CVE-2026-19424

CVE-2026-19424 affects Inventec Appliances’ Chiline Cloud. It describes an Insecure Direct Object Reference allowing unauthenticated remote attackers to modify a parameter to read other users’ sensitive data. The CVSS metrics indicate a high risk: CVSS‑3.1 base score 7.5 (NETWORK, LOW attack comp...

CVE-2026-19424

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

EUVD-2026-55877

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

PT-2026-70937

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

PT-2026-70031

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate tenant context in inbound requests. This allows an unauthenticated attacker to send specially crafted requests to spoof the tenant context,...

PT-2026-70904

『We recently revisited those patches and found that none of the underlying root causes were fixed - every original CVE remained exploitable,』😩 SonicWall GMS - Unauthenticated RCE and Encrypted Password Hash Extraction CVE-2026-66145 https://t.co/hp0HOWboM9...

PT-2026-70447

Name of the Vulnerable Software and Affected Versions Windows Hello affected versions not specified Description Sensitive information is stored in cleartext, which allows an authorized attacker to perform local tampering to affect the system. Recommendations At the moment, there is no information...

PT-2026-70621

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description An out-of-bounds read exists in Microsoft Office Word, which allows an unauthorized attacker to disclose sensitive information locally and affect the system. An out-of-bounds re...

Devolutions Server <= 2026.1.22 / 2026.2.0 <= 2026.2.11 Multiple Vulnerabilities (DEVO-2026-0024)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.22 or 2026.2.0 prior or equal to 2026.2.11. It is, therefore, affected by multiple vulnerabilities, including: - Improper authorization in the access request status endpoint allows an authenticated...

The vulnerability of the Lib/html/parser.py component of the Python programming language allows a hacker to gain access to confidential data and also trigger a service failure.

The vulnerability of the Lib/html/parser.py component of the Python interpreter is related to the insufficient use of the assert function. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, as well as cause service failures by generating distorted HTML...

PT-2026-70934

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

PT-2026-70049

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate certain incoming requests before forwarding them to backend destinations. An attacker with low privileges can send specially crafted request...

PT-2026-70052

Name of the Vulnerable Software and Affected Versions Chiline Cloud affected versions not specified Description Chiline Cloud developed by Inventec Appliances contains an Insecure Direct Object Reference IDOR issue. This occurs when an application provides direct access to objects based on...

Apache Tomcat 9.0.116 < 9.0.117 Missing Encryption of Sensitive Data Vulnerability (CVE-2026-34486)

The version of Tomcat installed on the remote host is 9.0.116 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146...

CVE-2025-30239 Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...