CVE-2026-109632: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits...

CVE-2026-103080: External Control of Assumed-Immutable Web Parameter

External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0...

EulerOS 2.0 SP13 : libkcapi (EulerOS-SA-2026-4062)

According to the versions of the libkcapi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an...

EulerOS 2.0 SP11 : libkcapi (EulerOS-SA-2026-4338)

According to the versions of the libkcapi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter...

PT-2026-110577

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description A missing authorization issue allows authenticated users with low privileges to create tenant-wide master data. This occurs because certain endpoints do not perform necessary role checks. An attacker ca...

ROS-20261012-73-0229

The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-111072

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.113.0 Frappe ERPNext versions 16.x prior to 16.24.0 Description Certain endpoints fail to enforce proper permission checks. This allows authenticated users to access and read financial data that exceeds the...

ROS-20261012-73-0265

The vulnerability of the xen-netback component in the Linux operating system’s kernel is related to incorrect checking of the amount of data at the input. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-111030

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.0 Description Authenticated users can read financial data beyond their permitted role due to missing authorization checks. This allows attackers to query endpoints to access sensitive financial records th...

CVE-2026-87744: Direct Request

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-109659: Missing Authorization

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109630: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits...

CVE-2026-109616: Missing Authorization

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits...

PT-2026-110491

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x Description The software fails to properly enforce the uniqueness of customer user identities when multiple CustomerUser backends, such as a database and LDAP, are configured...

CVE-2026-109610: Missing Authorization

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

PT-2026-110436

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description A flaw in the Biometric Data Endpoint component affects the /iclock/finger data/ endpoint. A remote attacker can achieve authorization bypass by manipulating the emp code argument...

CVE-2026-109658: Missing Authorization

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits...

PT-2026-110673

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.10.0 through 3.32.2 Description A heap buffer overflow occurs in the WinPR png write data callback when a realloc failure happens. A malicious RDP clipboard peer can trigger an out-of-bounds memcpy during PNG conversion by...

CVE-2026-92682: Incorrect Authorization

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-109652: Improper Neutralization of Special Elements Used in a Template Engine

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...