CVE-2026-65709

CVE-2026-65709 concerns sysPass up to version 3.2.11, with a missing object-level authorization vulnerability in the JSON-RPC API. The issue allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access checks. ...

CVE-2026-65708 sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65708 sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

EUVD-2026-48714

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65708

CVE-2026-65708 affects sysPass version 3.2.11. An insecure direct object reference in the AccountFileController lets any authenticated attacker access account file attachments they lack ACL permissions for by supplying arbitrary numeric file IDs in actions such as download, view, delete, upload, ...

CVE-2026-55731

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

CVE-2026-55731

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

EUVD-2026-48596

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

CVE-2026-55731 Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

SUSE-SU-2026:3238-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service bsc1271465. -...

CVE-2026-49743 GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlyin...

CVE-2026-13464

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-13464

The CVE concerns Kirki for WordPress (

CVE-2026-13464

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-13464 Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-48463

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-6454

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

PT-2026-64227

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

PT-2026-64375

Name of the Vulnerable Software and Affected Versions sysPass version 3.2.11 Description An insecure direct object reference occurs due to missing authorization checks in the AccountFileController. This allows an authenticated attacker to access account file attachments for which they lack Access...

openSUSE 16 Security Update : python-pyasn1 (openSUSE-SU-2026:21392-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21392-1 advisory. - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in...