BELL-CVE-2026-34293 CVE-2026-34293 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34276 CVE-2026-34276 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35238 CVE-2026-35238 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35240 CVE-2026-35240 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34308 CVE-2026-34308 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35236 CVE-2026-35236 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35237 CVE-2026-35237 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34304 CVE-2026-34304 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22005 CVE-2026-22005 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22017 CVE-2026-22017 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22001 CVE-2026-22001 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22004 CVE-2026-22004 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22002 CVE-2026-22002 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34267 CVE-2026-34267 does not affect BellSoft software

Bulletin has no description...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the PageRules::create process in the page rules component. An attacker can publish a page without the required status-change permission by creating it as a non-draft. This lets a user who is allowed to create...

EUVD-2026-25391

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...

CVE-2026-33318 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user including BASIC role can escalate to ADMIN on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: POST /account/change-password has no authorization check, allowin...

EUVD-2026-25345

OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable IPv6 addresses to bypass SSRF protections...

CVE-2026-42095

CVE-2026-42095 affects bookserver in KDE Arianna up to version 26.04.0 (pre-26.04.1). Affected component allows an attacker with local access to read arbitrary files by guessing a URL over a socket connection, as described in the vulnerability description. Root cause: insufficient access control ...

PT-2026-37177

Name of the Vulnerable Software and Affected Versions Avo versions prior to 3.31.2 Description A broken access control issue exists in the ActionsController due to insecure action lookup logic in the action class function. An authenticated user can execute any Action class that descends from...