CVE-2026-120823

A missing authorization check in the MongoDB Server aggregation framework allows a user with any valid credentials—including an account with no assigned roles—to access deployment-wide query configuration data . This data is normally restricted to cluster-level privileges, and unauthorized access...

CVE-2026-120815

An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server where authorization is enabled. This vulnerability could lead to unauthorized access to stored data and...

CVE-2026-120814

An improper privilege management issue exists in the sharding subsystem of MongoDB Server . A user with specific shard-level administrative privileges can cause persisted internal coordination state to be reprocessed with elevated internal authority . Because the system trusts this state without ...

CVE-2026-120977

Platforms running Arista EOS with 802.1X and DHCP device profiling enabled are vulnerable to a flaw where a network-adjacent attacker can send a crafted DHCP packet . This attack forces the device to record a spoofed device profile , potentially allowing an authenticated supplicant to gain unauth...

CVE-2026-95782

A vulnerability exists in a monitoring component that may, under certain conditions, allow security controls to be circumvented. Successful exploitation could result in unauthorized access to information intended for authorized users only. The specific affected software, versions, and root causes...

CVE-2026-95781

A security vulnerability exists in AthonetOS that may allow an unauthorized party to affect service operation or gain access to certain protected system functions . Successful exploitation could result in a compromise of service integrity or unauthorized system access . Specific details regarding...

CVE-2026-95780

A vulnerability exists in the authentication and session-management mechanisms which may prevent access from being fully terminated after certain account or session state changes. This allows a remote user with prior legitimate access to potentially retain access to protected system resources bey...

CVE-2026-125330

The self-hosted unified API for agent harnesses, HarnessRouter , is vulnerable to an authorization bypass in versions 0.4.2 through 0.31.7. The root cause is that routes accepting a session ID or response ID validate the caller's organization but fail to enforce workspace scope for non-default wo...

EUVD-2026-121705

pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pghba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top ...

Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats

Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts." In a notice publish...

BILLmanager 6 Web Interface Direct Object Reference Unauthorized Access

The vulnerability in the web interface of the BILLmanager 6 automation platform is related to the use of an unsafe direct object reference. Exploitation of this vulnerability may allow a remote attacker to gain unauthorized access to protected information...

Citeck Community Auth Bypass

The BPM platform Citeck Community vulnerability is related to flaws in its authentication process. Exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

CRM Platform Authentication Bypass

The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers, operating remotely, to circumvent existing security mechanisms and gain unauthorized access to...

Shtab Project Access Control Unauthorized Access

The vulnerability of the Shtab project and task management service is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Elph Mobile Hard-coded Key Unauthorized Access

The vulnerability in the Elph Mobile unified communications platform is related to the use of a hard-coded cryptographic key. Exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information...

YouGile Project Management Service Unauthorized Access

The vulnerability of the YouGile project management service is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

YouGile Project Management Service Unauthorized Access

The vulnerability of the YouGile project management service is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Centralized Printer MFP Supervision Unauthorized Access

The vulnerability of the software for centralized printer control and the Printsupervision printer system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

Test IT software testing management system Unauthorized Access

The vulnerability in Test IT’s software testing management system is related to improper handling of incoming requests. Exploitation of this vulnerability may allow a remote attacker to gain unauthorized access to protected information...

Doctor Near Telemedicine Premium Authentication Bypass

The vulnerability of the “Doctor Near. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...