nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

CVE-2026-72924

A flaw was found in GitHub CLI. The gh codespace ports forward command, by default, exposes forwarded services on all local network interfaces. This allows a network-adjacent attacker to access these services through the user's machine while port forwarding is active, even if the original...

PT-2026-84047

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the media move endpoint where permission checks are derived from the client-supplied collection value rather than the actual source collection of the med...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

EUVD-2026-68876

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

Incorrect Authorization

Overview org.pac4j:pac4j-core is a pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services. Affected versions of this package are vulnerable to Incorrect Authorization in the...

ASUS GT-AC2900 - Authentication Bypass

ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handlerequest in router/httpd/httpd.c and authcheck in webhook.o. An...

CVE-2026-70309

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-67729

Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...

CVE-2026-19412 Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability b...

CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...

EUVD-2026-67293

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device...

CVE-2026-76179

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

CVE-2026-75813

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

PT-2026-83283

Name of the Vulnerable Software and Affected Versions Hermes Agent version 0.16.0 Description An improper path restriction exists that allows attackers who can influence ingested message content to overwrite the credential store. This occurs by bypassing sensitive-path guards that failed to exclu...

PT-2026-83121

Name of the Vulnerable Software and Affected Versions CP Plus CP-XR-DE21-S affected versions not specified Description The CP Plus CP-XR-DE21-S Router contains hardcoded HTTP Digest authentication credentials within its firmware. These credentials are identical across all devices running the...

The vulnerability of the nltk.corpus.reader component in the NLTK library for symbolic and statistical processing of natural language allows a hacker to gain unauthorized access to protected information.

The vulnerability of the nltk.corpus.reader component in the NLTK library for symbolic and statistical processing of natural language is related to improper external management of file names or file paths. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protecte...

CVE-2026-75813

The Ebyte NE2-D11 device is affected by a missing authorization flaw in certain configuration endpoints. The root cause is a lack of proper server-side authorization checks , which allows unauthenticated, remote attackers to access or modify sensitive device settings. The impact is rated HIGH (CV...

CVE-2026-75813 Ebyte NE2-D11 Missing Authorization

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...