CVE-2026-94535

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...

CVE-2026-94535 lamp-cloud through 5.10.0 Unauthorized Notification Deletion

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...

CVE-2026-94535

lamp-cloud through 5.10.0 contains an authorization bypass (BOLA) in the deleteMyNotice endpoint. An attacker with valid credentials can call DELETE /anyone/extendNotice/deleteMyNotice with arbitrary notice IDs, permanently deleting notifications belonging to other users because the backend perfo...

CVE-2026-94535 lamp-cloud through 5.10.0 Unauthorized Notification Deletion

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...

WordPress PixelPlay plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary API Key Deletion vulnerability discovered by Phat RiO in WordPress Plugin PixelPlay versions = 1.0.2...

WordPress Custom Field Template plugin <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion vulnerability

Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Media File Deletion vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Custom Field Template versions = 2.7.8...

CVE-2026-48826

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group i...

EUVD-2026-84048

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks...

CVE-2026-69190

Graylog is an open-source log management platform. In versions 6.3.0 through 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary acc...

CVE-2026-48826

HomeBox , a home inventory and organization system, contains an authorization flaw in HandleWipeInventory (backend/app/api/handlers/v1/v1_ctrl_actions.go). The endpoint POST /v1/actions/wipe-inventory checks the global ctx.User.IsOwner value instead of the caller's role in the active group, which...

EUVD-2026-84034

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...

Security Bulletin: IBM Optim 1.1.0 impacted by vulnerability in lodash-es 4.17.21

Summary IBM Optim 1.1.0 includes lodash-es 4.17.21 as an npm dependency in the archon-ui component. This version is affected by CVE-2025-13465, a prototype pollution vulnerability that allows a remote attacker to manipulate JavaScript object prototypes via specially crafted input, potentially...

SUSE CVE-2026-25782

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue...

CVE-2026-55567

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect...

CVE-2026-55567

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect...

CVE-2026-48975: Authorization Bypass Through User-Controlled Key

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...

CVE-2026-55567: Time-of-check Time-of-use (TOCTOU) Race Condition

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect...

PT-2026-96108

Name of the Vulnerable Software and Affected Versions BleachBit versions prior to 6.0.1 Description Privileged cleaning on Windows fails to lock and validate the parent directory of a target before deletion. A local unprivileged user can replace this directory with a Windows junction and utilize ...

CVE-2026-92254 WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 driver versions 1.3.0.0 and earlier on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and...

CVE-2026-92254 WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 driver versions 1.3.0.0 and earlier on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and...