CVE-2026-72554

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...

EUVD-2025-210676

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

CVE-2026-48416: Incorrect Authorization

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction...

CVE-2026-21273: Improper Input Validation

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious...

CVE-2026-34635: Use of Hard-coded Cryptographic Key

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user...

CVE-2026-25652: Incorrect Authorization

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction...

CVE-2026-21279: Improper Input Validation

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction...

CVE-2026-71383: Incorrect Authorization

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this...

CVE-2026-48415: Incorrect Authorization

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

PT-2026-70818

Name of the Vulnerable Software and Affected Versions Magento Open Source affected versions not specified Adobe Commerce affected versions not specified Adobe Commerce B2B affected versions not specified Description An incorrect authorization flaw allows a remote attacker to bypass security...

PT-2026-70321

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An Improper Input Validation issue allows a low-privileged attacker to achieve privilege escalation, granting unauthorized read and write access. This...

CVE-2026-19539: Missing Authorization

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content title, description, and attachments of tickets belonging to another company, to hijack another company's...

CVE-2026-71384: Incorrect Authorization

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The...

CVE-2025-30240: Improper Link Resolution Before File Access

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

PT-2026-69994

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description TP-Link Aginet devices fail to properly validate symbolic links created on external USB storage devices. A symbolic link is a special type of file that serves as a reference to another...

EUVD-2026-54574

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

CVE-2026-70436

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check 1.4.0 and earlier or performs an improper permission check 1.4.1 when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to...

CVE-2026-71191

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...

CVE-2025-63822: Improper Access Control

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

PT-2026-68340

Name of the Vulnerable Software and Affected Versions SirenGPS Android Application version 2.19.44 Description An issue exists where the API fails to validate if the requesting user is authorized to access the target user's data. An authenticated attacker can manipulate user identifier parameters...