CVE-2026-86512

A flaw was found in java-json-tools json-patch. This vulnerability, located in the CopyOperation.apply and MoveOperation.apply functions, allows for improper access controls. A remote attacker could exploit this to potentially perform unauthorized operations, leading to impacts on confidentiality...

CVE-2026-86867

Cinnamon's Kotaemon (all versions up to and including v0.12.0 ) contains multiple vulnerabilities in its multi-user chat interface due to incorrect authorization and improper access controls . Four handler methods in libs/ktem/ktem/pages/chat/control.py (specifically select_conv, delete_conv, ren...

EUVD-2026-85508

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service

Summary Multiple vulnerabilities have been addressed in components of VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network...

EUVD-2026-85061

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to Java SDK

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Java and are addressed in version 6.1.0.5 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

PT-2026-97674

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker...

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...

CVE-2026-86867: Exposure of Sensitive Information to an Unauthorized Actor

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

CVE-2026-6718: Incorrect Default Permissions

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...

CVE-2026-77765: Improper Access Control

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...

Gitlab -- vulnerabilities

Gitlab reports: Double Free issue in Regular Expression Parser impacts GitLab CE/EE Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE Missing Authorization issue in Duo AI job troubleshooting...

CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-82368: Improper Access Control

Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches...

PT-2026-97494

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An improper access control issue exists in the '/api/v2/config/' endpoint, which is protected only by the IsAuthenticated permission. This allows any authenticat...

PT-2026-97421

Name of the Vulnerable Software and Affected Versions Kotaemon versions prior to 0.12.1 Description The multi-user chat interface contains improper access controls and incorrect authorization. Four handler methods in libs/ktem/ktem/pages/chat/control.py load conversation records using only the...

PT-2026-97577

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Improper access control allows unauthorized modification of application files. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2026-18462

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

CVE-2026-18462 Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...