EUVD-2026-60056

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

BIT-NIFI-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

BIT-GHOST-2026-70589 Ghost: Archived Offers can be Redeemed

Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1...

CVE-2026-19971

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

MINI-62JV-CCGX-6V32

Bulletin has no description...

MINI-8RCR-7J3W-578Q

Bulletin has no description...

EUVD-2026-60022

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

CVE-2026-19971 LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

CVE-2026-19971

CVE-2026-19971 affects LB-Link WR1210M firmware 1.0.3. The flaw resides in the Backup Endpoint component, specifically the /www/cgi-bin/backup.cgi main function, allowing missing authentication within the local network. In practical terms, an attacker on the same LAN could access or tamper with b...

CVE-2026-19971

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

MINI-99HG-853W-G7PP

Bulletin has no description...

MINI-R7PX-FJF5-M4XF

Bulletin has no description...

PT-2026-76824

Name of the Vulnerable Software and Affected Versions MLflow versions 3.13.0 through 3.14.x Description When deployed with the built-in basic-auth plugin, an authenticated user can inject arbitrary dataset records into another user's run. This occurs because the LogInputs proto handler is missing...

CVE-2026-54356: Missing Authorization

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

CVE-2026-69146: Missing Authorization

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFOREREQUESTHANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs...

PT-2026-76613

openssl encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...

PT-2026-76654

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8...

PT-2026-73188

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099498 advisory. ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099972)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099972 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that t...