open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket

A flaw was found in open-iscsi. An incorrect authorization vulnerability allows unprivileged local users to bypass authentication for the iscsiuio control socket. This enables unauthorized access to the control socket, potentially leading to system compromise or disruption of iSCSI Internet Small...

CVE-2026-77507

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2026-77507 Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2026-79938

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-55228

Weblate versions prior to 2026.7 contain a WebIDOR (Insecure Direct Object Reference) vulnerability in the GroupViewSet REST API endpoint. The API did not properly enforce the scope of project- and workspace-scoped teams, allowing an authenticated user with project-manager privileges to submit un...

CVE-2026-55228 Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

CVE-2026-55228 Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

EUVD-2026-66707

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-79938

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-79938

Dell PowerProtect Cyber Recovery , versions prior to 20.3 , is affected by an Improper Authentication vulnerability. A low-privileged attacker with remote network access can exploit this flaw to achieve unauthorized access . The CVSS 3.1 score is 7.6 (HIGH) , with the primary impact on integrity ...

CVE-2026-73501

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...

CVE-2026-79060

An incorrect authorization flaw was found in the StorageAccessAPI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=519254827...

CVE-2026-79021

A flaw was found in chromium-browser. This vulnerability, related to missing authorization in the InterestGroups component, allows a remote attacker to bypass system access restrictions. The attacker must first compromise the browser's rendering engine and then use a specially crafted PDF file to...

EUVD-2026-60382

Budibase authenticated arbitrary S3 signed upload URL issuance via /api/attachments/:datasourceId/url...

EUVD-2026-66279

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

Incorrect Authorization

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when a constraint for a longer path is specified before a more...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition due to a race condition in the setting of permissions for Unix domain sockets. An attacker can gain...

Insufficient Session Expiration

Overview org.apache.tomcat:tomcat-websocket is a Tomcat WebSocket JSR356 implementation. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when the associated HTTP session ends. An attacker can maintain access...

EUVD-2026-66125

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 throug...