CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the bulk delete process. An attacker can gain unauthorized access to and modify or disable accounts outside their permitt...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

EUVD-2026-70985

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85540

DreamMaker , a product developed by Interinfo , is affected by a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. The vulnerability is rated HIGH with a CVSS v3.1 base score of 8.8 (network vector, low com...

Malicious code in cors-registry-cross-env-alphard (npm)

Source: amazon-inspector 097b8707ff937202a007e6ec522d6f0159c12a69f763bba77779bf43607923ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cici-ruwet92-sluey (npm)

Source: amazon-inspector 4bbef97be045a92a31da2b100a4187d0b0e6fa556d6949a7e00b26853a447cf6 The package cici-ruwet92-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These package...

CVE-2026-80438

The Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1 ) contains an improper access control vulnerability in its REST API abilities. The plugin fails to restrict these abilities to administrators, incorrectly treating a plugin-specific capability as equivalent to full site administrati...

WordPress Ninja Forms plugin 3.14.0-3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability

Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability discovered by ChinhNguyen in WordPress Plugin Ninja Forms versions 3.14.0-3.15.1...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

A flaw was found in the Linux kernel's NFSv4 implementation. A local user could exploit a vulnerability where opening a file with OTRUNC truncate and ORDONLY read-only flags would bypass the necessary write permission checks. This oversight allows an attacker to truncate a file without having...

PT-2026-85444

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm modify or perm modify org permissions. The affected attribute deletion paths relied on organization membership checks performed by...

PT-2026-86254

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85787: Incomplete List of Disallowed Inputs

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85669: Missing Authorization

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

PT-2026-86250

Name of the Vulnerable Software and Affected Versions Trueview T18161 S version 6.0.23.4 Description Improper verification in MQTT command processing allows a network-based attacker to replay or modify captured MQTT messages. By manipulating security-related fields such as nonce, timestamp, and...

PT-2026-85803

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Non-Transparent Bridge ntb component where the original DMA address was not properly stored for future release. The DMA API requires that the dma free attrs functi...

CVE-2026-85547: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...