Important: dotnet8.0

Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-67664

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2025-15544

CVE-2025-15544 describes a cryptographic weakness in the Omada device adoption process where site management credentials are transmitted using a weak hashing algorithm, potentially allowing an attacker who intercepts adoption traffic to recover valid credentials and gain unauthorized access to ma...

CVE-2025-15544 Weak Credential Protection During TP-Link Omada Device Adoption

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

CVE-2026-68584 SiYuan before v3.7.3 Authentication Bypass via Content Endpoints

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-68584

CVE-2026-68584 affects SiYuan before v3.7.3. An authentication bypass exists in publish mode: content endpoints that return headings or backlinks (getHeadingChildrenDOM, getHeading*Transaction, getBacklinkDoc) do not enforce the password check, even though the main getDoc endpoint is protected. A...

EUVD-2026-52257

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-8793 PaperCut NG/MF: Insufficient brute-force protection

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanis...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service (DoS) flaw (CVE-2024-26308, CVE-2024-25710)

Summary IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service DoS flaw. All those libraries have been upgraded and this issue has been addressed in this release. Vulnerability Details CVEID:CVE-2024-26308...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (CVE-2026-4410)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service. This issue has been addressed i...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments incorporates Oracle's January 2026 Critical Patch Update (CPU) to fix multiple security vulnerabilities (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)

Summary IBM Storage Protect Data Protection for Virtual Environments incoprporates the security fixes related to Oracle's January 2026 Critical Patch Update CPU. The IBM SDK, Java Technology Edition Critical Patch Update CPU bundles several security updates from Oracle to address multiple...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to privilege escalation due to IBM WebSphere Application Server Liberty (CVE-2025-14915)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A privilege escalation vulnerability in IBM WebSphere Application Server Liberty, when the restConnector-1.0 or restConnector-2.0 feature is enabled,...

CVE-2026-18574 - Management Authentication Bypass

Symptoms - Impact: An unauthenticated attacker may be able to bypass Management authentication and execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. This issue was discovered internally, and Che...

SUSE CVE-2026-15722

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

Security Bulletin: IBM Storage Protect for Space Management is affected by multiple vulnerabilities in IBM SDK, Java Technology Edition (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary IBM Storage Protect for Space Management includes IBM SDK, Java Technology Edition to support Java-based components. Multiple vulnerabilities in IBM SDK, Java Technology Edition could allow an attacker to obtain unauthorized access to sensitive information or cause a partial denial of...

CVE-2026-50986

CVE-2026-50986 affects the PrestaShop module totadministrativemandate prior to 1.8.1. The root cause is a missing CSRF token in the payment validation controller, enabling CSRF exploitation to confirm an order in the awaiting state by hijacking a link. The CVSS vector indicates high impact to con...

The vulnerability of the Portainer container management platform, related to insufficient protection of registration data, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Portainer container management platform is related to insufficient protection of registration data. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...

CVE-2026-66756

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

UBUNTU-CVE-2026-66756

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

CVE-2026-66756

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...