CVE-2026-16772 CVE-2026-16772

In Akaunting versions sync call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by...

EUVD-2026-58679

A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available an...

MINI-92X7-695J-FQVV

Bulletin has no description...

MINI-8FWP-5G6P-4FXR

Bulletin has no description...

MINI-FHPC-5FR6-7X5V

Bulletin has no description...

MINI-XG77-75Q7-RQRX

Bulletin has no description...

CVE-2026-72835

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859

Budibase 3.39.4 before 3.40.0 contains an authorization regression in the S3 attachment upload endpoint. Affected component: the attachments endpoint used to generate S3 PutObject presigned URLs. Root cause: the route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC...

CVE-2026-72834

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72835

CVE-2026-72835 affects filebrowser before v2.63.21. The issue is that the application fails to canonicalize paths before evaluating access rules, allowing an authenticated user to bypass administrator-defined deny rules by using case-variant or backslash-separated paths. Attackers can request fil...

CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

EUVD-2026-58644

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions 4.16.6...

GO-2024-3113 vulnerabilities

Vulnerabilities for packages: vault...

GO-2026-4512 vulnerabilities

Vulnerabilities for packages: nuclei, commercial-expanso-edge...

GO-2023-1569 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

PT-2026-72128

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description An Insecure Direct Object Reference IDOR exists where a repository administrator can access notification configurations of other repositories by knowing or guessing the Universally Uniqu...

VulnCheck KEV: CVE-2026-59309

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...