CVE-2026-21074

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

CVE-2026-21074

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

CVE-2026-21074

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

CVE-2026-21074

Affected software: Samsung Bixby prior to 4.0.86.0. The issue stems from incorrect default permissions, enabling local attackers to execute arbitrary commands with Bixby privilege. Impact is local privilege escalation; attack requires local access with low privileges and no user interaction. The ...

EUVD-2026-55099

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

CVE-2026-17542

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...

EUVD-2026-55018

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerc...

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

PT-2026-69402

Name of the Vulnerable Software and Affected Versions Bixby versions prior to 4.0.86.0 Description Incorrect default permissions allow local attackers to execute arbitrary commands with Bixby privilege. Recommendations Update Bixby to version 4.0.86.0 or later...

PT-2026-69977

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.112.0 ERPNext versions prior to 16.23.0 Description An issue exists in the prepare conditions path of the ReceivablePayableReport within erpnext/accounts/report/accounts receivable/accounts receivable.py. The syste...

PT-2026-69965

Name of the Vulnerable Software and Affected Versions odh-dashboard affected versions not specified Description A flaw exists where the Service Account SA is granted overly broad permissions. An attacker who compromises the dashboard's SA token can exploit these permissions to escalate privileges...

CVE-2026-66000

Frappe (full-stack web framework) has an unrestricted access issue in Document Follow notifications prior to versions 16.23.0 and 15.112.0, where recipient permission checks are not re-evaluated for email data. This allows users whose access has been revoked or reduced to continue receiving docum...

CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-66000

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

EUVD-2026-54573

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-17603

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on...

CVE-2026-66059

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

EUVD-2026-54514

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment...

CVE-2026-17600

Nexus Repository 3 is affected by CVE-2026-17600 where a user’s active session is not immediately terminated or cached permissions revoked after account deletion, deactivation, or password change. The flaw allows a user with an active session to continue interacting with the repository as if the ...