EUVD-2026-11581

A vulnerability allowing a low-privileged user to extract saved SSH credentials...

CVE-2026-21670

A vulnerability allowing a low-privileged user to extract saved SSH credentials...

CVE-2026-21670

Veeam Backup & Replication versions prior to 13.0.1.2067 are affected by CVE-2026-21670, enabling a low-privileged user to extract saved SSH credentials. The issue is documented in the Veeam KB (KB4831) and is listed with a CVSS v3.1 score of 7.7 (High). Affected deployment types include Windows-...

PT-2026-25083

Summary In affected versions of openclaw, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set to trusted-proxy and the request arrived with proxy headers. A page served from an untrusted origin could connect through a trusted reverse proxy, inher...

EUVD-2026-11365

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes...

EUVD-2026-11361

An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges...

CVE-2026-1717

An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges...

CVE-2026-2640

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes...

CVE-2026-2640

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes...

CVE-2026-2640

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes...

CVE-2026-2640

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes...

CVE-2026-2640

CVE-2026-2640 affects Lenovo PC Manager. A local authenticated user could terminate privileged processes. CVSS metrics from Lenovo PSIRT: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (3.1) and CVSS v4.0: AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H. No explicit root cause, affected component version,...

CVE-2026-1717

CVE-2026-1717 affects the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying. An input validation vulnerability allows a local authenticated user to terminate arbitrary processes with elevated privileges. The advisory provides two CVSS assessments: CVSSv3.1 base score 5.5 (LO...

CVE-2026-0940

A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execute arbitrary code...

CVE-2026-32103

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocmsapi/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account...

CVE-2026-24509

CVE-2026-24509 affects Dell Alienware Command Center (AWCC) versions prior to 6.12.24.0. The Red Hat, CNVD, CNNVD, EUVD, NVD and related records describe an Improper Access Control vulnerability that can be triggered by a low-privileged attacker with local access, potentially leading to a Denial ...

EUVD-2026-11234

In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve the Observability Cloud API access token through the Discover...

CVE-2026-20166

In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve the Observability Cloud API access token through the Discover...

CVE-2026-30868 Cross-Site Request Forgery (CSRF) in opnsense/core

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...

CVE-2026-30868

OPNsense/CVE-2026-30868 is a CSRF flaw in the FreeBSD-based firewall platform where multiple MVC API endpoints allow state-changing actions via HTTP GET without CSRF protection. The CSRF validation in ApiControllerBase applies only to POST/PUT/DELETE, enabling an authenticated user to trigger pri...