CVE-2026-53565

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7...

CVE-2026-53565

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7...

CVE-2026-53565

CVE-2026-53565 is a Local Privilege Escalation in Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows. The CVE affects Secure Access Client for Windows versions before 26.6.1.20 and Endpoint Analysis Client for Windows before 26.5.1.7. The CVE is categorized as...

Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows Security Bulletin for CVE-2026-53565 and CVE-2026-53566

Severity - High Description of Problem Vulnerabilities have been discovered in the Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client. Refer to the information below for further details: Affected Versions: The following supported versions of Citrix Secure Access Client fo...

CVE-2026-15416 Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to missing authentication checks for the /codex endpoint, where requests bypass the API key validation before being rewritten to protected API routes, allowing unauthenticated attackers to invoke upstream LLM provider APIs...

Malicious code in fluterjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb8d561ceacd48c1883f6ec3151f5567240259b5ba54af3835fc0537f2f18933 The package's main and bin entry, server.js, starts an Express server bound to 0.0.0.0:10459 that exposes POST /ejecutar. The handler reads the JSON...

EUVD-2026-43547

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the...

EUVD-2026-43560

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any...

EUVD-2026-43551

The SCORM lab launch endpoint in Skillable scorm.skillable.com through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consum...

PT-2026-58676

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2026.2.11 Devolutions Server version 2026.1.22 Description Improper authorization in the access request status endpoint allows an authenticated low-privileged user to approve their own pending access request. This is...

CVE-2026-36035

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service DoS via removing the license from the webserver...

PT-2026-58099

Nexus Repository 3 is vulnerable to Server-Side Request Forgery SSRF via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects...

CVE-2025-56365

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster e.g., 0x34, the code incorrectly treats the endpoint as valid due to missing...

PT-2026-60102

Name of the Vulnerable Software and Affected Versions Anyquery affected versions not specified Description When operating in server mode, the software does not restrict outbound HTTP requests initiated by built-in SQLite virtual table modules, such as json reader and log reader. Unauthenticated...

PT-2026-58017

Name of the Vulnerable Software and Affected Versions Citrix Secure Access Client for Windows versions prior to 26.6.1.20 Citrix Endpoint Analysis Client for Windows versions prior to 26.5.1.7 Description Improper privilege management allows a low-privileged user with local access to escalate the...

PT-2026-58849

Name of the Vulnerable Software and Affected Versions Matter SDK connectedhomeip versions prior to 1.4.0 Description A reachable assertion issue exists in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster, the...

PT-2026-58851

Name of the Vulnerable Software and Affected Versions zhinianboke xianyu-auto-reply versions prior to 19fc3282a1bb78a05c34945c088525d20e081cbd Description An issue in the Backend User Endpoint allows remote attackers to perform manipulations that result in missing authorization. This occurs withi...

CVE-2025-56365

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster e.g., 0x34, the code incorrectly treats the endpoint as valid due to missing...

PT-2026-60107

Name of the Vulnerable Software and Affected Versions n8n-mcp versions prior to 2.57.4 Description In multi-tenant HTTP mode, an authenticated tenant can access local default-scope workflow versions backups instead of being restricted to their own tenant scope. This issue allows an authenticated...