CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-61726 Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-61726

The Tandoor Recipes application (prior to version 2.6.12 ) contains an authorization bypass in the StepViewSet and IngredientViewSet components. The root cause is that these components filter by active Space and use role-level CustomIsUser checks without verifying private-recipe ownership or shar...

CVE-2026-61726: Improper Access Control

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-59970: Server-Side Request Forgery (SSRF)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...

Progress MOVEit Transfer < 2025.1.6 / 2026.0.x < 2026.0.4 Multiple Vulnerabilities (September 2026)

The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.1.6 or 2026.0.x prior to 2026.0.4. It is, therefore, affected by multiple vulnerabilities, including: - Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer...

GHSA-5V7C-XPFP-P65M Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step (CVE-2026-101294)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step vulnerability. Vulnerability Details CVEID:CVE-2026-101294 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Applicatio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in applyconstrainttosize The step variable is initialized to zero. It is changed during the loop, but if it isn’t changed, it will remain zero. Add a variable check before the division...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.5.0 , the application fails to apply the RequireSecureSession middleware to several sensitive mutation routes, including the api/cluster router. This allows an authenticated user with a stolen or persisted JWT to bypass...

CVE-2026-84360: Authentication Bypass Using an Alternate Path or Channel

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

sgx-step

Un marco práctico de ataque para el control preciso de la ejecución de enclaves SGX-Step es un marco de trabajo de código abierto para facilitar la investigación de ataques de canal lateral en procesadores Intel x86 en general y en plataformas Intel SGX en particular. SGX-Step consiste en un...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: mesosphere-vsphere-csi, rclone, ingress-nginx-controller, flux, filebrowser, rancher, kubernetes, continuity, gitness, rancher-agent, spire-server, grafana, juicefs, headlamp, atlantis, temporal-ui-server, yunikorn-web, kube-arangodb, k8s-device-plugin,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: mesosphere-vsphere-csi, rclone, ingress-nginx-controller, flux, filebrowser, rancher, kubernetes, continuity, gitness, rancher-agent, spire-server, grafana, juicefs, headlamp, atlantis, temporal-ui-server, yunikorn-web, kube-arangodb, k8s-device-plugin,...

CVE-2026-103365

The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

GHSA-H246-WPGF-VMQ5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...