CVE-2026-109644: Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what the...

CVE-2026-109624: Missing Authorization

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits...

CVE-2026-109613: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109610: Missing Authorization

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

CVE-2026-109637: Missing Authorization

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records...

CVE-2026-109630: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits...

CVE-2026-109622: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising da...

CVE-2026-109616: Missing Authorization

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits...

PT-2026-111100

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

CVE-2026-107429: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-12613: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue...

CVE-2026-108802: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2026-108796: Authorization Bypass Through User-Controlled Key

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

PT-2026-111082

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.110.0 Frappe ERPNext versions 16.x prior to 16.21.0 Description Certain endpoints fail to enforce proper authorization checks during record status changes. This allows authenticated low-privileged users to...

CVE-2026-109614: Missing Authorization

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...

PT-2026-110733

Name of the Vulnerable Software and Affected Versions Grav Data Manager plugin versions 1.4.0 through 1.4.5 Description Missing authorization allows unauthenticated attackers to delete stored data files through the classic Admin integration. By sending a request containing the delete parameter...

CVE-2026-84418: Improper Certificate Validation

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...

PT-2026-110471

Name of the Vulnerable Software and Affected Versions y project RuoYi versions prior to 4.8.4 Description A remote cross site scripting issue exists in the Dictionary Data Drawer Preview component. The problem occurs within the renderDrawer function located in the /system/dict/data/add file. An...

CVE-2026-109180: Authorization Bypass Through User-Controlled Key

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...

Cisco NX-OS Data Compromise

The vulnerability of the Cisco NX-OS operating system is related to insufficient checks for data message or data structure correctness. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...