PT-2026-62413

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

PT-2026-61877

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A privilege escalation issue exists within the DOM: Workers component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

CVE-2026-60777: Improper Access Control

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object...

PT-2026-61878

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A privilege escalation issue exists within the DOM Navigation component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

PT-2026-61882

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A mitigation bypass exists within the DOM: Networking component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

PT-2026-61884

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A privilege escalation issue exists within the DOM: Content Processes component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

PT-2026-61890

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description An issue exists in the Document Object Model DOM specifically within the Copy & Paste and Drag & Drop component. Recommendations Update Firefox to version 153. Update...

PT-2026-61894

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A mitigation bypass exists within the DOM: Service Workers component. Service Workers are scripts that the browser runs in the background, separate from a web page,...

PT-2026-61900

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A sandbox escape exists within the DOM networking component. A sandbox is a security mechanism used to isolate running applications from the rest of the system to...

PT-2026-61911

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A site isolation issue exists within the DOM Navigation component. Site isolation is a security mechanism that ensures web pages from different sites are processed in...

PT-2026-61912

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description An information disclosure issue exists within the DOM Security component...

PT-2026-61919

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A mitigation bypass exists within the DOM: Service Workers component. Service Workers are scripts that the browser runs in the background, separate from a web page,...

PT-2026-61972

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description An insecure direct object reference IDOR issue exists that allows for account takeover. This occurs when an application provides direct access to objects based on user-supplied inpu...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into plain containers...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into...

GHSA-7Q8Q-RJ6J-MHJQ Axios: Nested axios option objects can consume polluted prototype values

Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinar...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in...

CVE-2026-47130

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...