PT-2026-67569

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

PT-2026-67558

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

PT-2026-67560

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

PT-2026-67550

Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...

CVE-2025-15544: Use of a One-Way Hash without a Salt

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

CVE-2026-48115: Improper Authorization

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...

CVE-2026-16057: Missing Authorization

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

CVE-2026-48399: Violation of Secure Design Principles

Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...

CVE-2026-69082: Cross-Site Request Forgery (CSRF)

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-68980: Incorrect Authorization

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

The vulnerability of Google Chrome’s Navigation function allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s Navigation function is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of Google Chrome’s Compositing component allows attackers to gain unauthorized access to protected information.

The vulnerability of the Compositing component in the Google Chrome browser is related to the execution of operations beyond the buffer boundaries in memory. Exploitation of this vulnerability may allow a malicious actor to gain unauthorized access to protected information...

PT-2026-67556

Improper control of generation of code 'code injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

PT-2026-67555

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...

PT-2026-67567

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

PT-2026-67563

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

PT-2026-67090

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

📄 OpenClaw Dashboard 3.0.0 Cross Site Scripting

OpenClaw Dashboard version 3.0.0 suffers from a persistent cross site scripting vulnerability in the Failed Login Username Field. Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS...

PT-2026-67457

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

CVE-2026-60011: Direct Request

Sharp and Toshiba Tec MFPs multifunction printers fail to properly authorize requests to directly access certain image data stored to the affected product...