PT-2026-97020

Name of the Vulnerable Software and Affected Versions Kaneo versions 2.3.12 through 2.12.1 Description Authenticated workspace members with viewer or member roles can delete and modify tasks beyond their assigned permissions. This occurs because the 'PATCH /api/task/bulk' endpoint verifies...

PT-2026-97071

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote authenticated attacker can access or modify unauthorized resources. This is caused by the use of wildcards in Role-Based Access Control RBAC permission definitions, which is a metho...

CVE-2026-18345: Missing Authorization

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2025-14484: Missing Authorization

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000573)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000573 advisory. Buffer Over-read in function findnextquote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and...

CVE-2026-95685: Missing Authorization

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission '' in the ACLComponent, making it accessible to any authenticated...

CVE-2026-79314: Improper Access Control

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

CVE-2026-63104: Missing Authorization

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000556)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000556 advisory. Buffer Over-read in function grabfilename in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification...

PT-2026-96662

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.19 Description The plugin allows unauthorized modification of data because the Connect::complete function lacks a capability check. This function is registered on the admin init hook, which executes for an...

PT-2026-97090

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A path traversal issue exists that could allow a remote authenticated attacker to modify server files. Path traversal is a flaw that allows ...

CVE-2026-18133: Improper Limitation of a Pathname to a Restricted Directory

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

CVE-2026-94534

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-94534 lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-94534 lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-94534

lamp-cloud through version 5.10.0 contains a Broken Object Level Authorization (BOLA) flaw in the PUT /anyone/baseInfo and PUT /anyone/avatar endpoints within its OAuth module. The root cause is a failure to validate that the target user ID in the request body matches the authenticated caller, al...

WordPress Image Buzz plugin <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary API Key Modification vulnerability discovered by Phat RiO in WordPress Plugin Image Buzz versions = 1.0.3...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion vulnerability

Authenticated Custom+ Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion vulnerability discovered by Nakul Chodha in WordPress Plugin Tutor LMS versions = 4.0.7...

CVE-2026-63116

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...