CVE-2026-59256

WWBN AVideo through commit 9c39d8c8 is affected by an authorization bypass vulnerability. The root cause is that the getToken() function creates tokens without binding them to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors . An attac...

CVE-2026-59256 WWBN AVideo Unbound Token Authorization Bypass via Gallery

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery...

EUVD-2026-64265

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery...

EUVD-2026-64264

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

CVE-2026-4245

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...

SUSE CVE-2026-73197

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

SUSE CVE-2026-73198

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...

PT-2026-79687

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5 Description An out-of-bounds write issue exists in the ALSA usb-audio component. The data ep set params function calculates the buffer size before accounting for the Format Type II transfer delimiter...

PT-2026-79647

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ALSA USB component. A previous fix for a UAF in the ump to endpoint function introduced a new UAF because the system attempts to dereference the...

PT-2026-79540

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit 9c39d8c8 Description An authorization bypass exists where the getToken function creates tokens that are not bound to a specific user identity or purpose. The endpoint 'plugin/Gallery/view/sections.php' issu...

PT-2026-79544

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An arbitrary file deletion flaw exists in the /api/search/removeTemplate endpoint. The application fails to validate the path parameter, which is passed directly to the os.RemoveAll function. This...

PT-2026-79576

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

PT-2026-79585

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An issue exists where the 'onUpdateComment' endpoint does not perform necessary access checks, allowing unauthenticated users to modify any comment. Recommendations Update to version 4.7.2 or later...

PT-2026-79584

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An issue exists where the 'onGetEmail' endpoint does not perform necessary access checks, allowing an unauthenticated user to disclose the email address of any commenter. Recommendations Update to...

Linux Distros Unpatched Vulnerability : CVE-2026-74642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint...

CVE-2026-53497

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-33240 Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

CVE-2026-53497

CrossWatch (a synchronization engine) prior to version 0.9.21 exposes an unauthenticated information disclosure via the GET /api/app-auth/status endpoint. The endpoint returns the other_sessions array without requiring credentials, leaking metadata for all active sessions including originating IP...

CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...