BELL-CVE-2026-34276 CVE-2026-34276 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35236 CVE-2026-35236 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35238 CVE-2026-35238 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-35240 CVE-2026-35240 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34304 CVE-2026-34304 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34293 CVE-2026-34293 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22004 CVE-2026-22004 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22002 CVE-2026-22002 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22017 CVE-2026-22017 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22005 CVE-2026-22005 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-22001 CVE-2026-22001 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2026-34267 CVE-2026-34267 does not affect BellSoft software

Bulletin has no description...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the PageRules::create process in the page rules component. An attacker can publish a page without the required status-change permission by creating it as a non-draft. This lets a user who is allowed to create...

EUVD-2026-25391

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...

CVE-2026-33318 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user including BASIC role can escalate to ADMIN on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: POST /account/change-password has no authorization check, allowin...

EUVD-2026-25345

OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable IPv6 addresses to bypass SSRF protections...

PT-2026-34876

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.2.1 Description The authenticated '/ui/dags' endpoint fails to enforce per-DAG access control on embedded Human-in-the-Loop HITL and TaskInstance records. This allows a logged-in user with read access to at least on...

PT-2026-37177

Name of the Vulnerable Software and Affected Versions Avo versions prior to 3.31.2 Description A broken access control issue exists in the ActionsController due to insecure action lookup logic in the action class function. An authenticated user can execute any Action class that descends from...

CVE-2026-42095

CVE-2026-42095 affects bookserver in KDE Arianna up to version 26.04.0 (pre-26.04.1). Affected component allows an attacker with local access to read arbitrary files by guessing a URL over a socket connection, as described in the vulnerability description. Root cause: insufficient access control ...

SICAM SIAPP SDK Container Length Discrepancy DoS

The vulnerability in the toolset used for creating and emulating SICAM SIAPP SDK containers is related to improper handling of discrepancies in parameter length. Exploiting this vulnerability can allow attackers to trigger a service failure...