PT-2026-111102

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can obtain sensitive information due to an exposure of sensitive data to an unauthorized actor. Recommendations At the moment, there is no...

CVE-2026-92682: Incorrect Authorization

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-109661: Missing Authorization

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial da...

CVE-2026-82096: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-109652: Improper Neutralization of Special Elements Used in a Template Engine

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-92681: Missing Authentication for Critical Function

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-109659: Missing Authorization

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits...

PT-2026-111032

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.3 Frappe ERPNext versions prior to 16.35.0 Description Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to send requests to these endpoints to modify data th...

CVE-2026-109625: Missing Authorization

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

CVE-2026-21133: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...

PT-2026-111030

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.0 Description Authenticated users can read financial data beyond their permitted role due to missing authorization checks. This allows attackers to query endpoints to access sensitive financial records th...

PT-2026-111072

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.113.0 Frappe ERPNext versions 16.x prior to 16.24.0 Description Certain endpoints fail to enforce proper permission checks. This allows authenticated users to access and read financial data that exceeds the...

CVE-2026-109632: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits...

CVE-2026-82103: Exposure of Sensitive Information to an Unauthorized Actor

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2026-3195)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3195 advisory. A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG Scalable Vector Graphics CSS Cascading Style Sheets data. A loca...

CVE-2026-109673: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

PT-2026-111037

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.120.0 Frappe ERPNext versions 16.x prior to 16.33.0 Description Certain endpoints fail to enforce proper permission checks, leading to a missing authorization issue. This allows authenticated users with low...

cirro

Cirro es una plataforma extensible de investigación en seguridad que permite a investigadores y testers de penetración recolectar, analizar y visualizar entornos en la nube y relaciones de identidad a través de bases de datos de grafos. Construida con una arquitectura modular, Cirro puede...

fuzzowski

Fuzzowski █ █ ████████ ██████████ ██ ████ ██ ██ ████ ██ ████ ████ █ ████████████ █ █ ██████████ █ Fuzzowski Network Fuzzer █ █ █ █ 🄯 Fuzzers, inc. ██ ██ by Mario Rivas La idea es ser el Fuzzer de Protocolos de Red que queramos usar. El objetivo de esta herramienta es ayudar durante todo el proces...

evine

Evine Web Crawler CLI interactivo. Evine es un web crawler y web scraper simple, rápido e interactivo escrito en Golang. Evine es útil para una amplia gama de propósitos, como extracción de metadatos y datos, minería de datos, reconocimiento y pruebas. Si te gusta el proyecto, dale una estrella...