CVE-2026-85956: Improper Privilege Management

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or...

ROS-20261012-73-0189

The vulnerability of the uverbscmd.c component in the Linux operating system is related to incorrect checking of the amount of data at the input stage. Exploiting this vulnerability can allow an attacker to cause a service failure...

Cisco NX-OS Data Compromise

The vulnerability of the Cisco NX-OS operating system is related to insufficient checks for data message or data structure correctness. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

CVE-2026-87744: Direct Request

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-21133: Undefined Security Weakness

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...

CVE-2026-109643: Missing Authorization

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned...

CVE-2026-109636: Missing Authorization

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted rol...

CVE-2026-109672: Missing Authorization

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-108796: Authorization Bypass Through User-Controlled Key

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

CVE-2026-109627: Missing Authorization

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

PT-2026-110599

Name of the Vulnerable Software and Affected Versions UYAP Document Editor versions prior to 5.4.21 Description Deserialization of untrusted data in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This occurs when the application...

PT-2026-110904

Name of the Vulnerable Software and Affected Versions HAProxy Data Plane API versions 2.2.0 through 2.9.28 HAProxy Data Plane API versions 3.0.0 through 3.0.24 HAProxy Data Plane API versions 3.1.0 through 3.2.16 HAProxy Data Plane API versions 3.3.0 through 3.3.8 HAProxy Data Plane API versions...

CVE-2026-85972: Incorrect Implementation of Authentication Algorithm

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication...

CVE-2026-109670: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

CVE-2026-96618: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-109330: Missing Origin Validation in WebSockets

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page th...

CVE-2026-109316: Missing Authorization

Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files...

CVE-2026-109673: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

CVE-2026-107429: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

PT-2026-110673

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.10.0 through 3.32.2 Description A heap buffer overflow occurs in the WinPR png write data callback when a realloc failure happens. A malicious RDP clipboard peer can trigger an out-of-bounds memcpy during PNG conversion by...