.NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

Windows Network Address Translation (NAT) Spoofing Vulnerability

Origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network...

Visual Studio Code Security Feature Bypass Vulnerability

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Microsoft Office Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

Visual Studio Code Remote Code Execution Vulnerability

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...

Microsoft Teams Remote Code Execution Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...

CVE-2026-72535

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

CVE-2026-72554 Ladybird Web Solution Faveo Helpdesk - Broken Access Control

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...

CVE-2026-72540

Red Hat CNA-LR concluded that this CVE is not valid...

CVE-2026-72540

This CVE was rejected by Red Hat CNA-LR as not valid. However, EUVD and PT Security describe an insecure direct object reference (IDOR) in PhotoPrism through commit bb0b933. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving ...

EUVD-2026-56010

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...

CVE-2026-72540

...

CVE-2026-72536 Chaskiq Chaskiq - Missing Authentication

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...

TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool

More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-021...

CVE-2026-34191

A flaw was found in Apache Portable Runtime Utility. This vulnerability, known as SQL Injection, occurs in the aprdbdoracle provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the...

CVE-2026-68079

A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the removeCodeGrant functionality, which fails to properly invalidate used...

SUSE CVE-2026-58443

Public-only repository tokens can update private PR head branches...

PT-2026-70667

Name of the Vulnerable Software and Affected Versions Microsoft Teams Mobile affected versions not specified Description An issue in Microsoft Teams Mobile allows an unauthorized actor to disclose sensitive information over a network. Recommendations At the moment, there is no information about a...

PT-2026-70341

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user...