EUVD-2026-41860

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

The vulnerability of the `__do TraceF2FS-Unlink-Enter()` function in the `include/trace/events/f2fs.h` module of the Linux operating system allows a malicious actor to gain unauthorized access to protected information or cause service failures.

The vulnerability of the do Tracef2fsunlinkenter function in the include/trace/events/f2fs.h module of the Linux operating system is related to data processing errors. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protected information or cause service failure...

ROS-20260706-73-0016

The vulnerability of the timeofday function in the PostgreSQL database management system is related to the use of uncontrolled format strings. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2025-13475

Technical details about CVE-2025-13475 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-8079

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized...

CVE-2026-9272 Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS

In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System ADS may send specially crafted requests that could result in unauthorized access to application data and its...

CVE-2026-9272

CVE-2026-9272 affects Progress Flowmon ADS prior to 12.5.6 and 13.0.5. An adversary authenticated as a low-privileged ADS user can send specially crafted requests that lead to unauthorized access to and modification of application data. The CVE’s metrics indicate HIGH impact on confidentiality, i...

CVE-2026-11600

The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs and Off Canvas widget's template rendering in versions up to, and including, 1.4.26. The render method of the Tabs...

CVE-2026-56152

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

CVE-2026-5120

A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user...

CVE-2026-5120 Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026

A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user...

EUVD-2026-40956

A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user...

CVE-2026-5120

A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user...

CVE-2026-1239

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for...

PT-2026-54784

Name of the Vulnerable Software and Affected Versions BIOVIA Workbook versions Release 2021 through Release 2026 Description A Race Condition occurs when the timing or sequence of events is unplanned, potentially leading to unexpected behavior. In this case, the issue could allow a user to access...

CVE-2026-58448

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation...

PYSEC-2026-394 llama_index vulnerable to SQL Injection

Multiple vector store integrations in run-llama/llamaindex version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index...

The vulnerability of NVIDIA’s ONNX library allows for the execution of arbitrary code, granting attackers enhanced privileges, unauthorized access to protected information, and the ability to replace data.

The vulnerability of the ONNX library’s Model Optimizer function relates to the restoration of unreliable data in memory. Exploiting this vulnerability can allow attackers to execute arbitrary code, gain enhanced privileges, obtain unauthorized access to protected information, and replace data...

The vulnerability of the function drm_dp_get_adjust_request_post_cursor() in the drivers/gpu/drm/drm_dp_helper.c module of Linux kernel allows a hacker to gain unauthorized access to protected information or cause service failure.

The vulnerability of the drmdpgetadjustrequestpostcursor function in the drivers/gpu/drm/drmdphelper.c module of Linux operating systems is related to reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform allows a perpetrator to gain unauthorized access to read, update, or delete protected information.

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform is related to access control errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read, update, or delete protected information...