kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's ip6gre and ip6erspan tunnel drivers. The changelink functions in these drivers do not adequately verify administrative capabilities CAPNETADMIN across different network namespaces. This allows a local attacker, who has CAPNETADMIN in one network namespace bu...

CVE-2026-95785

A vulnerability exists in a system component that may, under certain conditions, allow an authorized user to make unauthorized changes to system-managed content. Successful exploitation could affect system confidentiality, integrity, and availability, and may disrupt trusted interactions among...

EUVD-2026-122896

A vulnerability exists in a system component that may, under certain conditions, allow an authorized user to make unauthorized changes to system-managed content. Successful exploitation could affect system confidentiality, integrity, and availability, and may disrupt trusted interactions among...

CVE-2026-95785

Technical details are not publicly available in the provided documents. The description identifies a vulnerability in a system component allowing an authorized user to make unauthorized changes to system-managed content , potentially impacting confidentiality, integrity, and availability. No spec...

PT-2026-144674

A vulnerability exists in a system component that may, under certain conditions, allow an authorized user to make unauthorized changes to system-managed content. Successful exploitation could affect system confidentiality, integrity, and availability, and may disrupt trusted interactions among...

PT-2026-137293

This module enables you to send messages "Notifications" to users upon a certain Workflow state change. The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes...

CVE-2026-115708

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

CVE-2026-113696 Improper Authorization in BMC ITSM SmartIT Change Approvals

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions...

CVE-2026-107060

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences...

PT-2026-132391

Name of the Vulnerable Software and Affected Versions Tailscale version 297862600 Description Insecure permissions in the Android application allow an unauthorized attacker to make arbitrary changes to another user's VPN configurations and preferences. Recommendations At the moment, there is no...

PT-2026-132152

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

EUVD-2026-110579

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery CSRF vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service DoS attack on the device...

BoneIO Black processing logic error vulnerability

In boneIO Black versions from 1.2.0 up to but including 1.6.0, there is a logic error vulnerability stemming from a lack of clickjacking protection. This allows remote attackers to embed control panels within iframes of malicious web pages, tricking authenticated users on the internal network int...

SUSE CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

Linux Distros Unpatched Vulnerability : CVE-2026-114125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a...

CVE-2026-46708

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the targ...

CVE-2026-46708

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the targ...

CVE-2026-46708 EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the targ...