PT-2026-89495

New Plesk security alert: a symlink race condition in Backup Manager CVE-2026-68488 allows users with just FTP and panel access to gain root on Linux servers. Affects Plesk for Linux versions 18.0.80.6- and 18.0.79.10- branches. Patch to 18.0.80.7+ or 18.0.79.11+, especially if you run shared or...

PT-2026-89283

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITYSYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

PT-2026-89260

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK EDITOR permission to plant a VQL...

PT-2026-89365

There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...

PT-2026-89374

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/ backend/private/invite new user to org.ts. The POST /private/invite new user to org endpoint only requires the org.update...

PT-2026-89294

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

AlmaLinux 9 : 389-ds-base (ALSA-2026:64784)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64784 advisory. 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasliostartpacket CVE-2026-18355 389-ds-base:...

PT-2026-89373

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/ backend/utils/hono middleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and...

PT-2026-89261

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

Oracle Linux 8 : ELSA-2026-64791-0: / 389-ds:1.4 (ELSA-2026-647910)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-647910 advisory. - Resolves: RHEL-222326 - EMBARGOED CVE-2026-18453 389-ds:1.4/389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results...

389-ds:1.4 security, bug fix, and enhancement update

1.4.3.39-28 - Bump version to 1.4.3.39-28 - Resolves: RHEL-222326 - EMBARGOED CVE-2026-18453 389-ds:1.4/389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USEONEBACKEND control in opsharedsearch rhel-8.10.z - Resolves: RHEL-220511 - EMBARGOED CVE-2026-1835...

AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

Overview An incorrect permissions assignment vulnerability in the amwrtdrv.sys kernel driver, included with AOMEI Backupper 8.4.0, allows an unprivileged local user to perform arbitrary writes to the physical disk. When Secure Boot is disabled, this can be leveraged to execute arbitrary UEFI-leve...

CVE-2026-71807

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

CVE-2026-87998 Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/id/delete in backend/openwebui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection...

CVE-2026-87998

Open WebUI (versions 0.10.0 through 0.11.1 ) contains an authorization flaw in the knowledge base deletion endpoint (DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py). The endpoint validates permissions against the knowledge base itself but then removes the associat...

CVE-2026-87016 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, getuserbyoauthsub and getuserbyscimexternalid in backend/openwebui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject...

CVE-2026-87016 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, getuserbyoauthsub and getuserbyscimexternalid in backend/openwebui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject...

CVE-2026-87014

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-19816

A flaw was found in PackageKit. In the dnf5 backend, the RepoRemove handler ignores the SIMULATE transaction flag and executes a real package removal, allowing an unprivileged local user to uninstall packages without polkit authorization. Mitigation Affects v1.3.4 through v1.3.6. Fixed in commit...

Security Bulletin: Vulnerability in js-yaml affects IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is susceptible to a Privilege Escalation / Denial of Service CVE-2026-64718 threat due to the use of js-yaml. js-yaml is part of Node.js, which is used by TS7700 to provide the Management Interface. Vulnerability Details CVEID:CVE-2025-64718 DESCRIPTION:...