CVE-2026-72547

CVE-2026-72547 affects Attendize (Attendize project) via the postImportAttendee endpoint. The flaw is an insecure direct object reference: the system loads the target event by ID without verifying ownership against the requesting organiser account, enabling any authenticated event organiser to bu...

CVE-2026-72547 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72547

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72546 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

EUVD-2026-56016

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72546 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72546

Attendize CVE-2026-72546 is an insecure direct object reference in the postInviteAttendee endpoint, exploitable by any authenticated event organiser to inject attendees and orders into events owned by other accounts. The endpoint loads the target event by ID without scoping to the authenticated o...

wifi: mwifiex: bound uAP association event IEs to the event buffer

...

wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

RLSA-2026:52761 Moderate: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: iio: event: Fix event FIFO reset race CVE-2026-64496 For more details about the security issues, including the impact, a CVSS scor...

kernel-rt security update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

RLSA-2026:52765 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: iio: event: Fix event FIFO reset race CVE-2026-64496 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer ...

PT-2026-70121

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

PT-2026-70420

Name of the Vulnerable Software and Affected Versions Windows Event Logging Service affected versions not specified Description A buffer over-read in the Windows Event Logging Service allows an authorized attacker to disclose information locally. A buffer over-read occurs when a program reads mor...

PT-2026-70122

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-48804: Allocation of Resources Without Limits or Throttling

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

PT-2026-70406

Name of the Vulnerable Software and Affected Versions Windows Event Logging Service affected versions not specified Description A race condition exists in the Windows Event Logging Service. This occurs when concurrent execution using a shared resource lacks proper synchronization, allowing an...

PT-2026-70416

Name of the Vulnerable Software and Affected Versions Windows Event Logging Service affected versions not specified Description The use of an uninitialized resource in the Windows Event Logging Service allows an authorized attacker to disclose information locally. Recommendations At the moment,...

CVE-2026-59126: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...