CVE-2026-27462

Combodo iTop , a web-based IT service management tool, is vulnerable to user enumeration via its password reset mechanism prior to version 3.2.3. The root cause is that the application returns different responses for valid and invalid usernames depending on multiple factors during the reset proce...

CVE-2026-27462 Combodo iTop: User enumeration via password reset

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3...

CVE-2026-27462 Combodo iTop: User enumeration via password reset

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3...

USN-8668-1 linux-gcp-5.15 vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

USN-8668-1: Linux kernel (GCP) vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

Security Bulletin: IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [CVE-2026-18527, CVE-2026-17203].

Summary IBM Application Runtime Expert ARE for IBM i is vulnerable to a user gaining elevated privileges due to ARE GUI component processing CVE-2026-18527 and allow an attacker to obtain sensitive information CVE-2026-17203 as described in the vulnerability details section. Vulnerability Details...

CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability in the Settings resource. The read policy uses an always-allow authorization check that bypasses all identity verification, allowing unauthenticated attackers to send a GET request to the settings API endpoint with a valid reco...

Hikvision - Authentication Bypass

Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0...

EUVD-2026-64067

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

CVE-2026-30866 Combodo iTop: Insecured access to uploaded images via sniffed url

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3...

EUVD-2026-64066

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3...

CVE-2026-30866

Combodo iTop , a web-based IT service management tool, is vulnerable to unauthenticated access to uploaded sensitive data (specifically images) via a sniffed URL in versions prior to 3.2.3 . An attacker with network access can discover and retrieve uploaded files without any authentication, resul...

CVE-2026-43820

A flaw was found in swift-nio-ssl. This vulnerability arises from the improper handling of Subject Alternative Names SANs within SSL certificates. When processing SANs that are not backed by an ASN1STRING, the system attempts to access memory outside of its allocated buffer, leading to an...

CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

EUVD-2026-64060

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

CVE-2026-58214

A flaw was found in NATS Server, a high-performance messaging system. An authenticated MQTT Message Queuing Telemetry Transport client could bypass security permissions by subscribing to an internal subject family. This unauthorized access allows the client to view sensitive MQTT Quality of Servi...

CVE-2026-58211

A flaw was found in NATS Server, a high-performance messaging system. This vulnerability allows a client to bypass normal authentication and connection restrictions by registering as a "noauthuser" through a specific parser path. This occurs when the client's initial operation is not a standard...