CLEANSTART-2026-YK34202 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

CVE-2026-59739 affects multiple packages. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. See references for individual vulnerability details...

PT-2026-107782

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data across...

CVE-2026-84249: Missing Authentication for Critical Function

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

CVE-2026-107395: Missing Authorization

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...

CVE-2023-5648: Improper Neutralization of Input During Web Page Generation

In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...

PT-2026-107929

Name of the Vulnerable Software and Affected Versions Visual Composer Website Builder versions prior to 45.16.3 Description An issue exists in the Visual Composer Website Builder where missing authorization allows the exploitation of incorrectly configured access control security levels...

PT-2026-108055

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.34.0 through 1.107.3 Pydantic AI versions 2.x and earlier Description The Agent.to web and clai web development chat endpoints lack request content-type validation. This allows a website visited by a developer to submit ...

Oracle Linux 7 : ELSA-2026-67157-0: / sg3_utils (ELSA-2026-671570)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-671570 advisory. 1:1.37-19.0.3 - Backport fix for CVE-2026-16313 Orabug: 40020335 Tenable has extracted the preceding description block directly from the Oracle Linux security...

PT-2026-108254

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

PT-2026-108204

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...

CVE-2026-107779: Missing Authentication for Critical Function

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...

CVE-2026-104076: Missing Authentication for Critical Function

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...

PT-2026-107803

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...

PT-2026-107822

In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...

CVE-2026-84272: Missing Authentication for Critical Function

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...

CVE-2026-107623: Missing Authorization

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-106596: Missing Authorization

Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3...

CVE-2026-85421: Missing Authentication for Critical Function

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

CVE-2026-86827: Missing Authorization

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

PT-2026-108280

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.2 and 12.2.2 Description A missing authentication requirement for a critical function allows a remote attacker to execute arbitrary management operations. Recommendations At the moment, there is no...