PT-2026-70852

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the applyOps command allows an authenticated user with specific non-default privileges to perform unauthorized data-definition operations, such as dropping or modifying...

CVE-2026-72536: Missing Authentication for Critical Function

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...

PT-2026-81155

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description Failure to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent. repr svg allows for arbitrary code execution. Attackers can exploit bare-name...

CVE-2026-72907 ERPNext: Broken Access Control on certain endpoint

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2025-13294

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

Security update for PackageKit

This update for PackageKit fixes the following issues: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaS...

CVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

CVE-2026-71576 Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

CVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

DEBIAN-CVE-2026-16742

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user...

CVE-2026-16742

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user...

Exploit for CVE-2026-15598

CVE-2026-15598 A weakness has been identified in antv layou...

CVE-2026-72593 dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-60074

A flaw was found in Date::Manip. This vulnerability allows an attacker to provide specially crafted input containing non-ASCII decimal digits to the Date::Manip library for Perl. The library's parsing logic incorrectly processes these digits, truncating the input and resulting in an inaccurate da...

CVE-2026-15229

The Pinpoint Booking System WordPress plugin (versions through 2.9.9.7.1 ) contains a vulnerability where the booking price is not validated on the server side. This flaw allows unauthenticated users to create bookings at an arbitrary price , such as zero. By selecting a specific payment method, ...

CVE-2026-15229 Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...

EUVD-2026-55008

The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...

CVE-2026-15229 Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...