EUVD-2026-77353

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

CVE-2026-88852

Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla 7.0.0, Snippets Pro extension for Joomla 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the...

PT-2026-91135

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

PT-2026-91134

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...

CVE-2026-68570: Incorrect Authorization

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...

CVE-2026-72524: Incorrect Authorization

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

CVE-2026-81941

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...

CVE-2026-81941

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary operating system command execution when an authenticated non-administrative user constructs a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_CO...

PT-2026-89637

🚨 CVE-2026-81941 IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local std...

CVE-2026-33391

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

EUVD-2026-72788

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

CVE-2026-33391 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

CVE-2026-33391 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

PT-2026-87078

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2026-3255)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2026-3330)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

CVE-2026-86417

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-33997 DESCRIPTION: Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins...

CVE-2026-84989

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...