CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

CVE-2026-67394

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...

CVE-2026-67394

Plesk for Linux versions 18.0.34 through before 18.0.79.9 and 18.0.80.5 are affected by a critical local privilege escalation via OS command injection (CVSS 4.0: 9.0). An attacker who already has shell access (or is allowed to change their own shell) can escalate to the root account on the hostin...

EUVD-2026-68921

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...

EUVD-2026-68882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

PT-2026-84216

Name of the Vulnerable Software and Affected Versions FactoryTalk Activation Manager affected versions not specified Description A privilege escalation issue exists due to custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repa...

PT-2026-84423

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An arbitrary file write issue exists in the API of the software, which could allow an authenticated administrative user to escalate privileges. Successful exploitation...

PT-2026-84476

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A privilege escalation issue exists in the API endpoint of AOS-CX. This allows an authenticated user with low privilege operator permissions to modify the state of specific system settings...

PT-2026-84417

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Local privilege-escalation flaws allow a local attacker to execute arbitrary code with root privileges on the underlying operating system of the affected system...

PT-2026-84409

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An arbitrary file write flaw exists in the API of HPE Networking Fabric Composer. This issue allows an authenticated user with low privilege operator permissions to...

CVE-2026-52111

CVE-2026-52111 affects fast-note-sync-service versions ≤ 2.13.7 . The root cause is that the admin configuration endpoint exposes the authTokenKey , enabling a remote attacker with no prior privileges to escalate their access. The vulnerability is scored CVSS 9.8 (Critical) with a network attack ...

PT-2026-84315

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An OS Command Injection issue exists where an authenticated user with limited privileges can execute arbitrary commands with root privileges. OS Command Injection is a flaw that allow...

PT-2026-84431

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An issue in the API of HPE Networking Fabric Composer allows an authenticated user with low privilege operator permissions to access sensitive information. This flaw...

PT-2026-84250

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description A protection mechanism failure allows an authenticated user with limited privileges to bypass access restrictions and gain escalated privileges. Recommendations At the moment, there i...

PT-2026-84350

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An incorrect authorization issue allows a low privileged attacker with remote access to potentially elevate their privileges. Recommendations At the moment, there is no information...

PT-2026-84428

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Privilege escalation issues exist in the API of HPE Networking Fabric Composer. An authenticated user with low privilege operator permissions can exploit this to modify...

PT-2026-84471

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An authenticated low-privileged user can execute arbitrary commands as a privileged user on the underlying operating system through affected command-line...

PT-2026-84176

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird ESR versions prior to 153.2 Description A use-after-free issue exists in the Graphics: WebGPU component, which could lead to...

Mozilla Thunderbird < 140.15

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.15. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-87 advisory. - Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in...

RHEL 10 : libXfont2 (RHSA-2026:62123)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62123 advisory. X.Org X11 libXfont2 runtime library Security Fixes: libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679...