CVE-2026-1840

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without...

PAN-OS Command Line Privilege Escalation

The vulnerability of the command-line interface of the PAN-OS operating system’s network interfaces in the PA-Series, VM-Series, and M-Series virtual devices is related to the absence of authentication. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

Oracle WebCenter Sites Data Compromise

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

CVE-2026-7167: Exposure of Sensitive Information to an Unauthorized Actor

The vulnerability arises when the system fails to properly validate the 'email' field during the authentication process, allowing unverified or fake email addresses to be accepted. This lack of validation enables the creation of user accounts with fake email addresses, facilitating the mass...

PT-2026-82342

Уязвимость системы для автоматизации ИТ- и бизнес-процессов Naumen Service Management Platform связана с отсутствием авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

PT-2026-99454

Name of the Vulnerable Software and Affected Versions org.http4k:http4k-security-digest versions prior to 6.48.0.0 org.http4k:http4k-security-digest versions prior to 5.42.0.0 org.http4k:http4k-security-digest versions prior to 4.51.0.0 Description The Digest authentication module defaults the...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code within the authorized user’s session...

EUVD-2026-32916

PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS...

CVE-2026-47739

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0...

CVE-2026-47739: Improper Neutralization of Input During Web Page Generation

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0...

CVE-2026-45674: Insufficient Verification of Data Authenticity

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue...

CVE-2026-47238

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can upload subtitles, edit their name or delete them. This issue has been patched in version 5.5.3 - 1...

CVE-2026-47165

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 an...

CVE-2026-53469

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments,...

QNAP qumagie 信息泄露漏洞

QNAP Systems QuMagie is a QTS photo management application developed by QNAP Systems. There is a security vulnerability in QNAP Systems QuMagie, which stems from lack of authorization. This vulnerability may allow remote attackers to access unauthorized data or perform unauthorized operations. Th...

Anthropic’s Project Glasswing Update

In April, Anthropic initated Project Glasswing. The idea was to let companies use their new model to find and fix vulnerabilities in their own software. It was a fantastic PR move, and so many press outlets have uncritically parroted Anthropic's claims that it's now common wisdom that Mythos is...

CVE-2026-46440: Insufficiently Protected Credentials

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2...

FortiSandbox Authentication Bypass RCE

The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...

BELL-CVE-2026-46250

Bulletin has no description...

CVE-2026-39331

ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorization by simply changing the familyId parameter in requests, regardless of whether they possess the required EditRecords privilege...