PT-2026-111032

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.3 Frappe ERPNext versions prior to 16.35.0 Description Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to send requests to these endpoints to modify data th...

PT-2026-110599

Name of the Vulnerable Software and Affected Versions UYAP Document Editor versions prior to 5.4.21 Description Deserialization of untrusted data in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This occurs when the application...

CVE-2026-21127: Improper Export of Android Application Components

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data...

CVE-2026-82110: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal...

CVE-2026-106605: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price...

PT-2026-110577

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description A missing authorization issue allows authenticated users with low privileges to create tenant-wide master data. This occurs because certain endpoints do not perform necessary role checks. An attacker ca...

PT-2026-110637

🚨 CVE-2026-109194 A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanent...

PT-2026-111102

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can obtain sensitive information due to an exposure of sensitive data to an unauthorized actor. Recommendations At the moment, there is no...

CVE-2026-109661: Missing Authorization

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial da...

CVE-2026-82096: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-109652: Improper Neutralization of Special Elements Used in a Template Engine

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-92681: Missing Authentication for Critical Function

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-109659: Missing Authorization

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-21133: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...

PT-2026-111030

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.0 Description Authenticated users can read financial data beyond their permitted role due to missing authorization checks. This allows attackers to query endpoints to access sensitive financial records th...

PT-2026-111072

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.113.0 Frappe ERPNext versions 16.x prior to 16.24.0 Description Certain endpoints fail to enforce proper permission checks. This allows authenticated users to access and read financial data that exceeds the...

CVE-2026-109632: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits...

CVE-2026-82103: Exposure of Sensitive Information to an Unauthorized Actor

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor...

CVE-2026-92682: Incorrect Authorization

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-109625: Missing Authorization

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...