CVE-2026-102157: Authorization Bypass Through User-Controlled Key

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

PT-2026-107334

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper access control in the vertex result caching subsystem allows a remote authenticated attacker to obtain sensitive information or inject malicious data. Recommendations Update I...

CVE-2026-42413: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate = 1.3.2 versions...

CVE-2026-106585: Improper Handling of Highly Compressed Data (Data Amplification)

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

PT-2026-106468

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...

PT-2026-106388

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning = 1.5.17 versions...

PT-2026-106471

Unauthenticated Sensitive Data Exposure in Norvis Backup = 1.1.0 versions...

PT-2026-106361

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

PT-2026-107139

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A stored cross-site scripting XSS issue allows an unauthenticated attacker with adjacent-network access to inject malicious content. This content executes when ...

PT-2026-106337

Name of the Vulnerable Software and Affected Versions Fast Courier versions prior to 5.2.4 Description The Fast Courier WordPress plugin fails to restrict an unauthenticated REST route used for writing order fulfillment data. This allows unauthenticated attackers to overwrite the courier status a...

PT-2026-107143

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

CVE-2026-102407: Incorrect Authorization

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

PT-2026-106332

Name of the Vulnerable Software and Affected Versions Sitemovr versions prior to 1.0.2 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 1.0.1...

PT-2026-107156

Name of the Vulnerable Software and Affected Versions Kibana versions 8.14.0 through 8.19.21 Kibana versions 9.0.0 through 9.4.6 Kibana versions 9.5.0 through 9.5.3 Description An authorization bypass exists in the Fleet package installation process where a user with delegated package-management...

PT-2026-107295

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.5.1 Backstage versions prior to 3.6.2 Backstage versions prior to 3.7.2 Backstage versions prior to 3.8.2 Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains improp...

PT-2026-106472

Unauthenticated Sensitive Data Exposure in Snapshotify All-in-One Backup & Restore & Migrate = 1.3.2 versions...

CVE-2026-57537: Use After Free

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization...

CVE-2026-104399: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124...

ROS-20261006-73-0119

The vulnerability of the spiregistercontroller function in the drivers/spi/spi.c module of the Linux operating system’s SPI device driver lies in the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2026-107138

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...