CVE-2026-48935

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

PT-2026-52942

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the f2fs module, the f2fs sbi show function reads extension list, extension count, and hot ext count without holding the sb lock. If a concurrent sysfs store operation modifies the...

GO-2026-5425 Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator

Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator...

github.com/containers/podman: Podman: Host filesystem modification via malicious container image WORKDIR symlink

A flaw was found in Podman. A remote attacker can exploit this vulnerability by running a malicious container image where the WORKDIR working directory path contains a symbolic link symlink. This can lead to the creation of a directory or modification of ownership on the host filesystem,...

CVE-2026-53095

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct ptregs. Since the actual program type of uprobe is KPROBE, it can be abused to modify struct ptregs via kprobe+freplace when the kprobe...

EUVD-2026-38963

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct ptregs. Since the actual program type of uprobe is KPROBE, it can be abused to modify struct ptregs via kprobe+freplace when the kprobe...

CVE-2026-11877

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2026-11877

CVE-2026-11877 affects OpenText Access Manager prior to 5.1.3. An unauthorised user can modify configuration via API calls, indicating a missing authorization vulnerability. Supported details show the impact is at the configuration level (no data leakage described) with remote network access requ...

EUVD-2026-38792

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3...

CVE-2026-9184

The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatelb24token AJAX function in versions up to, and including, 2.2. The handler only verifies the 'lb24' nonce which is generated and localized to any...

CVE-2026-9172

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due to a missing capability check on the deletesingleaccount function in versions up to, and including, 1.2.0. The REST route...

CVE-2026-8688

The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

EUVD-2026-38673

The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatelb24token AJAX function in versions up to, and including, 2.2. The handler only verifies the 'lb24' nonce which is generated and localized to any...

CVE-2026-8614

The CVE concerns the WordPress Assistio plugin (versions ≤ 1.1.2). A missing capability check and missing nonce verification in assistio_plugin_delete_assistio_settings() allows authenticated users with Subscriber-level access and above to modify data, including deleting the critical assistiobot_...

CVE-2026-12851 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. libNetSetObj.so is an internal library...

PT-2026-51819

Name of the Vulnerable Software and Affected Versions OpenText Access Manager versions prior to 5.1.3 Description An unauthorized user can modify configuration through API calls, which impacts the OpenText Access Manager. Recommendations Update OpenText Access Manager to version 5.1.3 or later...

PT-2026-51681

Name of the Vulnerable Software and Affected Versions SearchPlus versions prior to 1.7.2 Description The SearchPlus plugin for WordPress allows unauthenticated users to modify or delete stored data. This occurs because the searchplus save token action callback and searchplus reset token action...

The vulnerability of the TarFile.ExtractToDirectory method in the .NET software platform allows a malicious actor to gain access to and modify data.

The vulnerability of the TarFile.ExtractToDirectory method in the .NET software platform is related to the incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability could allow an attacker to gain access to and modify data...

PT-2026-51695

Name of the Vulnerable Software and Affected Versions 24liveblog versions prior to 2.3 Description The 24liveblog plugin for WordPress allows unauthorized data modification because the update lb24 token AJAX function lacks a proper capability check. The handler verifies the 'lb24' nonce but fails...