CVE-2026-28724

Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 41186...

CVE-2026-28724

Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 41186...

GHSA-C36C-7PC2-F2PH Gokapi has Data Leak in Upload Status Stream

Description The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting user. Impact Any authenticated user can observe other users' file identifiers and retrieve unauthorized...

Unauthorized data access due to insufficient access control validation

...

CVE-2026-28696 Craft affected by IDOR via GraphQL @parseRefs

Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags e.g., user:1:email, can be abused by both authenticated users and unauthenticated guests if a Public Schema is enabled to access sensitive...

HPESBNW05026 rev.2 - Multiple Vulnerabilities in HPE Aruba Networking Wireless Operating Systems (AOS-8 and AOS-10) for Mobility Conductors, Controllers, Gateways, and Access Points.

Potential Security Impact: Remote: Bypass Security Restrictions, Denial of Service DoS, Unauthorized Data Injection, Unauthorized Data Modification, Unauthorized Read Access to Data SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 630 Series Access Points - Please refer to th...

CVE-2026-3431: Missing Authorization

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including...

ASB-A-483074175

In multiple locations, there is a possible way to access unexpected data due to multiple causes. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-27838 wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling self.getobject. In versions up to and including 2.4, ache keys are scoped only by pk — no user ID is included. When a victim has previously accessed their routine via the API...

CVE-2025-14742

The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajaxsearchrecipes' and 'ajaxgetrecipe' functions in all versions up to, and including, 10.2.3. This makes it possible for authenticated attackers, with Subscriber-level...

wger 安全漏洞

WGER is an open-source project developed by the WGER Team, written in Django, and serves as a self-hosted FLOSS fitness/exercise, nutrition, and weight tracking application. Versions of WGER 2.4 and earlier contained security vulnerabilities, which were caused by improper handling of cache key...

CVE-2026-27607: Improper Input Validation

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads PostObject, allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enabl...

CVE-2026-22568

CVE-2026-22568 affects the ZIA Admin UI. An authenticated administrator could potentially retrieve unauthorized internal information due to improper neutralization of certain input in rare conditions. The CVSS 3.1 base score is 5.5 (Medium) with Privileges Required: High, User Interaction: None, ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime (CVE-2026-21945,CVE-2026-21932,CVE-2026-21933, CVE-2026-21925 & CVE-2026-1188))

Summary IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily exploitable vulnerability issue that allows an remote attacker to cause...

CVE-2026-26988: Improper Neutralization of Special Elements used in an SQL Command

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajaxtable.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically,...

The vulnerability of the 3D model texturing program Adobe Substance 3D Designer, related to reading beyond the permitted range in memory, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the 3D model texturing program Adobe Substance 3D Designer lies in the reading of data beyond the permitted range in memory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information, provided that the user opens a specially...

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software lies in the incorrect limitation of the path name to the directory. This allows a intruder to gain unauthorized access to the protected information.

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerabilities of Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM), related to reading data outside of the allowed range in memory, allow attackers to gain unauthorized access to protected information.

The vulnerability of Intel Active Management Technology AMT and Intel Standard Manageability ISM is related to reading data outside of the allowed range in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

WordPress plugin One to one user Chat by WPGuppy 访问控制错误漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

Vulnerabilities fixed in Apple macOS

Apple has fixed vulnerabilities in macOS, including versions Sequoia 15.7.4, Tahoe 26.3 and Sonoma 14.8.4. The vulnerabilities include memory corruption issues, unauthorized access to sensitive user data, and logging issues that could lead to unauthorized access to location information. The updat...