CVE-2025-62300 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

CVE-2025-62300 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

WordPress Amelia plugin 7.0-9.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Amelia versions 7.0-9.6...

CVE-2026-76610

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

EUVD-2026-63237

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

CVE-2026-76610

Zoo (a Joomla extension by YOOtheme ) versions prior to 4.1.65 contain an access control flaw in the comment controller endpoint . The endpoint lacked ACL checks, enabling unauthenticated users to modify tags remotely over the network with no user interaction required. The CVSS 4.0 base score is ...

PT-2026-78946

Name of the Vulnerable Software and Affected Versions HCL IntelliOps Event Management IEM affected versions not specified Description A race condition exists in the software. This creates a timing window that allows an attacker to modify a resource, leading to unpredictable behavior. A race...

PT-2026-80208

Impact The backend FileUpload form widget trusted an attacker-controlled file id POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global system files table without verifying that the file belonged to the widget's...

CVE-2026-19683: Cleartext Transmission of Sensitive Information

A vulnerability exists in the Dynamic DNS DDNS functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and th...

CVE-2026-53569: Missing Authorization

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...

The vulnerability of the PostgreSQL database management system, related to incorrect session expiration times, allows attackers to gain unauthorized access to read and modify data.

The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...

The vulnerability of the ALTER TABLE ALTER TYPE command in the PostgreSQL database management system allows a hacker to gain unauthorized access to delete or modify data.

The vulnerability of the ALTER TABLE/ALTER TYPE command in the PostgreSQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to delete or modify data...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the spring.cloud.config.server.svn.basedir...

CVE-2026-76371

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

CVE-2026-76342 Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

EUVD-2026-62737

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorizationcode OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...

GHSA-C6W2-J4WQ-MVWG Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

Impact Due to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company companyid = null. While direct instance authorization isCurrentUserHasAccess correctly denies access to these out-of-scope...