CVE-2026-86285: Improper Access Control

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...

PT-2026-86658

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...

CVE-2026-77697: Improper Privilege Management

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

CVE-2026-86294: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

Linux Distros Unpatched Vulnerability : CVE-2026-80815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status...

Linux Distros Unpatched Vulnerability : CVE-2026-86091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools an...

CVE-2026-77699: Improper Privilege Management

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

Exploit for SQL Injection in Sangoma Freepbx

CVE-2025-57819 — FreePBX 16 Endpoint Manager unauthenticated S...

GHSA-RGWJ-5XJ2-C3M3 vulnerabilities

Vulnerabilities for packages: sqlpad...

CVE-2024-24919

CVE-2024-24919 Description CVE-2024-24919 is a critical information disclosure vulnerability affecting various Check Point security products, including Quantum Security Gateways and CloudGuard. It has a high CVSS score of 8.6 and allows unauthenticated attackers to read sensitive files from the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073366)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073366 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053227)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053227 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacrubind Syzbot is still reporting quite an old issu...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073352)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073352 advisory. In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnetdellink rmnetdellink removes the endpoi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: etcd (UTSA-2022-001270)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001270 advisory. In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include...

Malicious code in eth-lib-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8d2399c30a7656138ab2024250aeb8814c3ccd32e0104f87933eece367a829 The package presents itself as an Ethereum balance helper, but on the first call to the advertised getEthLibBalance API it invokes...

MAL-2026-15981 Malicious code in eth-lib-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8d2399c30a7656138ab2024250aeb8814c3ccd32e0104f87933eece367a829 The package presents itself as an Ethereum balance helper, but on the first call to the advertised getEthLibBalance API it invokes...

CVE-2026-86190

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

CVE-2026-12843

The LearnDash LMS WordPress plugin is affected by an authorization bypass in versions 4.25.0 through 5.1.6 , caused by improper verification of user authorization via a REST endpoint. Unauthenticated attackers can enroll arbitrary users in paid courses without payment verification, effectively by...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...