CVE-2026-86060 SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS...

CVE-2026-86060 SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS...

CVE-2026-67279 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

EUVD-2026-72027

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

OESA-2026-3660 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn...

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on the glossary management API endpoints. Any authenticated user can send POST, PUT, or DELETE requests to create, modify, or delete glossary entries, allowing tampering with instance-wide business glossary data withou...

WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability

Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...

CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

CVE-2026-84901

The Eventin WordPress plugin (versions before 4.1.22 ) contains a missing authorization vulnerability in several event-management REST routes . This flaw allows users with contributor-level access or higher to perform unauthorized actions, including changing the site's front-page setting to an ev...

EUVD-2026-71774

A flaw was found in Flatpak. A Time-of-check to time-of-use TOCTOU race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy function. An attacker c...

SUSE CVE-2026-76925

A flaw was found in Flatpak. A Time-of-check to time-of-use TOCTOU race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy function. An attacker c...

GHSA-M4RF-3FR8-XWX3 vulnerabilities

Vulnerabilities for packages: nemo, open-webui...

EUVD-2026-71691

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for...

CVE-2026-85638 jofpin trape user.py authorization

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for...

CVE-2026-85638 jofpin trape user.py authorization

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for...

EUVD-2026-71688

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist...

CVE-2026-14470

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2026-18175

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by an improper authorization flaw (CWE-285) in the DDM target dispatcher component of Distributed Data Management. A remote attacker with no prior access could manipulate database transactions , resulting in high integrity impact and low confiden...

CVE-2026-85602

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...