EUVD-2026-47812

Conditions administration did not consistently enforce tokens and component/mapped-item permissions...

CVE-2026-63280 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions...

CVE-2026-64796

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

CVE-2026-64796

CVE-2026-64796 concerns the Joomla Sourcerer extension by regularlabs.com, with multiple code injection vectors. The Free version allegedly lets both the article creator and last modifier execute article PHP without needing Super User privileges; the Pro version reportedly fails to consistently e...

CVE-2026-64791

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or...

GO-2026-6022 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim in github.com/cloudreve/Cloudreve

Cloudreve: OAuth access tokens bypass scope enforcement due to missing clientid claim in github.com/cloudreve/Cloudreve...

CVE-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...

GHSA-4V35-78JC-648R Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpg6-x68q-5793. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the...

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public...

UBUNTU-CVE-2026-8593

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows users without permissions to view and modify BI packs and rules...

CVE-2026-8593

CVE-2026-8593 affects Checkmk BI API Pack permission enforcement in versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL). The issue allows users without permissions to view and modify BI packs and rules. The provided metrics indicate a CVSS v4.0 base score ...

EUVD-2026-46165

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows users without permissions to view and modify BI packs and rules...

PT-2026-63297

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A route-specific authorization failure allows a personal access token restricted to the public-only scope to retrieve private organization membership and permission details. While direct access...

PT-2026-63277

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description RSS and Atom feed handlers fail to enforce token-scope or public-only restrictions when using API-token Basic authentication. This allows a personal access token that is restricted to public-only access or lack...

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement vulnerability discovered by ? in WordPress Npm body-parser versions 1.20.6...

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

Impact When body-parser is configured with an invalid limit option value, such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept...

GHSA-VGJ4-345G-JCF8 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Summary Cloudreve's OAuth access tokens can bypass OAuth scope enforcement. This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say RequiredScopes... should verify scopes...

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Summary Cloudreve's OAuth access tokens can bypass OAuth scope enforcement. This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say RequiredScopes... should verify scopes...

CVE-2026-13724

Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation. This issue affects Corporate Training Management System: before dd1a9df64...