CVE-2026-16938 Power System Missing Authorization

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to...

CVE-2026-16930

Power Systems Firmware versions FW1120.00, FW1110.00–.30, and FW1060.00–.80 are affected by CWE-862 (Missing Authorization), allowing a privileged BMC/FSP user to execute arbitrary code on the host and all partitions. Upgrade to FW1110.31, FW1120.01, or FW1060.81 (or newer) per the IBM Security B...

CVE-2026-16930 Power System Missing Authorization

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system,...

CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...

CVE-2026-55703

Snipe-IT (IT asset/license management system) prior to 8.6.3 contains an authorization bypass in MaintenancesController::show(). The method renders a maintenance record without calling authorize(), unlike all sibling actions (index, edit, update, destroy) which properly gate on the asset. Any act...

CVE-2026-55483 Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin...

CVE-2026-55483 Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin...

DEBIAN-CVE-2026-55192

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP serve...

CVE-2026-19875

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...

CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

EUVD-2026-62606

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...

CVE-2026-20357

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-61033

creationtimestamp| type| source ---|---|--- 2026-08-19 17:17:11+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-23 13:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtqu7y7ynf2v...

MINI-P4VR-WQ8C-2HV5

Bulletin has no description...

MINI-9X5C-2P7H-JM6M

Bulletin has no description...

MINI-H2M8-5J4R-9P9W

Bulletin has no description...

CVE-2026-20357

Cisco Crosswork has multiple missing-authentication vulnerabilities (CWE-306) in critical functions, rated CVSS 10.0 (network, no privileges required). No specific affected versions or fix details are provided in the documents; exploitation status is also not available. Monitor the Cisco security...

CVE-2026-20357 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

EUVD-2026-62565

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...