MINI-942G-8V78-8H95

Bulletin has no description...

MINI-PPH2-V5HC-CQX8

Bulletin has no description...

MINI-36F3-HR43-VRXQ

Bulletin has no description...

MINI-53JX-P9PJ-2M68

Bulletin has no description...

MINI-V33V-384C-VPXC

Bulletin has no description...

MINI-CMRP-G767-QRGH

Bulletin has no description...

MINI-WFCW-5XCW-XH5W

Bulletin has no description...

MINI-GQQQ-5483-952X

Bulletin has no description...

MINI-7CPR-4RRJ-XG8J

Bulletin has no description...

MINI-HM6R-5353-X3F2

Bulletin has no description...

MINI-X7C3-9J46-8V68

Bulletin has no description...

MINI-XGFM-74CH-HQR7

Bulletin has no description...

MINI-CFVV-PH5J-MRV8

Bulletin has no description...

MINI-32JX-3XFG-235H

Bulletin has no description...

BIT-GITLAB-2025-12506 Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from t...

PT-2026-59571

Summary Type: Insecure Direct Object Reference. The issue CRUD endpoints GET / PATCH / DELETE /workspaces/workspace id/issues/issue id gate access on require workspace memberworkspace id only, then resolve issue id through IssueService.getissue id which is a primary-key lookup with no workspace...

PT-2026-59565

Summary Type: Insecure Direct Object Reference. The comment endpoints POST /workspaces/workspace id/issues/issue id/comments and GET .../comments gate access on require workspace memberworkspace id only, then call CommentService.createissue id=issue id, ... and CommentService.list for issueissue ...

PT-2026-59563

Summary Type: Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspace id/agents/agent id gate access on require workspace memberworkspace id only, then resolve agent id through AgentService.getagent id which is a primary-key lookup with no workspace...

WordPress Academy LMS plugin <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by sorawautsukushiii in WordPress Plugin Academy LMS versions = 3.8.0...

PT-2026-59643

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values. Patches This has been fixed in pypdf==6.10.1. Workarounds If you cannot upgrade yet,...