CVE-2026-68570 Apache Doris: Authorization bypass leading to unauthorized data access

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...

CVE-2026-72524

Apache Doris contains an Incorrect Authorization vulnerability that allows an authenticated user to bypass privilege checks. This flaw enables unauthorized users to access or modify data, specifically allowing a low-privilege user to read, write, or drop arbitrary tables. The issue affects versio...

CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

EUVD-2026-77353

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

CVE-2026-90894

Parallels Desktop (macOS) contains a local privilege escalation vulnerability in the prl_disp_service daemon, which runs as root . Local clients reach it via a world-writable socket, and PrlSrv_LoginLocal accepts peer credentials with no signature or admin-group check. After login, PrlSrv_Install...

EUVD-2026-77346

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

SUSE-SU-2026:4156-1 Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen

This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues: Changes in MozillaFirefox: Firefox Extended Support Release 153.2.0 ESR Fixed: Various security fixes. MFSA 2026-85 bsc1278001: CVE-2026-75874: Sandbox escape in the...

Vulnerabilities in Microsoft Azure

Microsoft has identified 4 vulnerabilities in various Azure components. A malicious individual could exploit these vulnerabilities to carry out attacks that can lead to various types of damage, as mentioned in the table below. The vulnerability with identifier CVE-2026-69854 has a CVSS score of...

WordPress User Registration & Membership plugin < 5.2.8 - Author+ Privilege Escalation to Administrator vulnerability

Author+ Privilege Escalation to Administrator vulnerability discovered by Baikuya in WordPress Plugin User Registration versions 5.2.8...

WordPress Simple Membership plugin < 4.7.8 - Subscriber+ Membership Level Escalation vulnerability

Subscriber+ Membership Level Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin Simple Membership versions 4.7.8...

WordPress User Registration & Membership plugin 4.4.6-5.2.7 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin User Registration versions 4.4.6-5.2.7...

WordPress WP Component plugin <= 2.2.4 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin WP Component versions = 2.2.4...

WordPress Add User Autocomplete plugin < 1.2 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Nguyen Huu Do in WordPress Plugin Add User Autocomplete versions 1.2...

WordPress MemberPress Corporate Accounts plugin <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by andrea bocchetti in WordPress Plugin MemberPress Corporate Accounts versions = 1.5.39...

CVE-2026-12518

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...

Security update for NetworkManager

This update for NetworkManager fixes the following issues: CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass...

SUSE-SU-2026:4148-1 Security update for NetworkManager

This update for NetworkManager fixes the following issues: - CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation...