CVE-2026-72546 Attendize Attendize - Insecure Direct Object Reference

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-34191

A flaw was found in Apache Portable Runtime Utility. This vulnerability, known as SQL Injection, occurs in the aprdbdoracle provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the...

go-git: Malicious reference names may modify files outside the reference storage

...

Exploit for SQL Injection in Nagios Nagios_Xi

CVE-2023-48084 — updated PoC Repository: MettHK/CVE-2023...

EUVD-2025-210674

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...

PT-2026-70139

Name of the Vulnerable Software and Affected Versions BadChoice Handesk versions prior to 2026-07-10 Description Broken access control allows any authenticated agent to update ticket records belonging to other teams. This occurs because the 'TicketsController@update' endpoint does not call an...

PT-2026-70230

Name of the Vulnerable Software and Affected Versions NETGEAR affected versions not specified Description Insufficient input validation allows authenticated administrators connected to the local network to make unauthorized modifications to the device software and functionality. Recommendations A...

PT-2026-70033

Name of the Vulnerable Software and Affected Versions SAP ABAP Development Tools affected versions not specified Description SAP ABAP Development Tools fails to perform required authorization checks for specific functionality. This allows an attacker with low privileges to execute unauthorized...

CVE-2026-11735: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality...

PT-2026-70935

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 2.0.0-rc6 Description Kestra serves Micronaut management endpoints on port 8081 without authentication, bypassing the Basic Auth protection applied to the /api/v1/ endpoints on port 8080. This allows unauthenticated...

CVE-2026-11736: Improper Input Validation

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality...

CVE-2026-9214: Improper Input Validation

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

PT-2026-70029

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description The WebSocket component of SAP Approuter fails to perform sufficient authorization checks within certain functionality. This allows an attacker with low privileges to access restricted...

PT-2026-70239

Name of the Vulnerable Software and Affected Versions NETGEAR R7000 affected versions not specified Description Insufficient input validation allows authenticated administrators connected to the local network to make unauthorized modifications to the router software and functionality...

CVE-2026-11737: Improper Input Validation

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...

CVE-2026-72546: Authorization Bypass Through User-Controlled Key

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-11738: Improper Input Validation

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

CVE-2026-72595: Improper Access Control

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

PT-2026-70864

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in Queryable Encryption maintenance operations allows an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of da...

PT-2026-70229

Name of the Vulnerable Software and Affected Versions NETGEAR affected versions not specified Description A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory. This issue...