EUVD-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

CVE-2026-54336 JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...

PT-2026-71631

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path confinement bypass allows remote clients to escape the intended inner-module root confinement. This occurs when the module root contains a /./ boundary marker, enabling the construction of paths...

CVE-2026-53793: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-67568

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-67568 Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-67568 Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

EUVD-2026-56847

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

CVE-2026-21279

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction...

CVE-2026-25652 ColdFusion | Incorrect Authorization (CWE-863)

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction...

CVE-2026-25652

CVE-2026-25652 is an Incorrect Authorization vulnerability affecting Adobe ColdFusion (per APSB26-90). The issue allows a low-privileged attacker with local access to escalate privileges and perform unauthorized read and write actions. Exploitation does not require user interaction. The CVSS-like...

PT-2026-70351

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An Incorrect Authorization issue allows for a security feature bypass. An attacker can bypass security measures to obtain limited unauthorized read and write...

CVE-2026-67568: Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2025-63822

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

CVE-2026-10031 SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

SUSE CVE-2026-39429

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard...

CVE-2026-10031: Incorrect Authorization

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

PT-2026-65479

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...