PT-2026-63500

Name of the Vulnerable Software and Affected Versions Regular Labs extension affected versions not specified Description Administrator actions, editor popups, and import/export requests lack consistent token, item-permission, and input-validation checks. This allows unauthorized backend users or...

Oracle MySQL Cluster 9.x < 9.7.2 (July 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are...

The vulnerability of the Adobe Media Encoder application, related to reading beyond the buffer in memory, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Adobe Media Encoder application relates to reading beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-13059: Reliance on Untrusted Inputs in a Security Decision

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

PT-2026-63501

Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise...

PT-2026-63365

A flaw was found in the Ansible Lightspeed Model Context Protocol MCP server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the...

PT-2026-63432

Name of the Vulnerable Software and Affected Versions Froiden TableTrack versions prior to 1.3.11 Description A stored cross-site scripting issue exists where unauthenticated attackers can inject arbitrary HTML and JavaScript. This occurs because the order notes field does not properly sanitize...

Plone < 4.2.6 / 4.3.x < 4.3.2 Multiple Vulnerabilities (HF 20130618)

The version of Plone installed on the remote host is prior to 4.3.2. It is, therefore, affected by the following vulnerabilities: - traverser.py allows remote attackers with administrator privileges to cause a denial of service infinite loop and resource consumption via unspecified vectors relate...

PT-2026-63496

Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization...

ROS-20260722-73-0010

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to a violation of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-63353

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.30.1 n8n versions prior to 2.29.8 Description The Token Exchange module assigns all Public API key scopes to issued JSON Web Tokens JWTs, ignoring the actual role of the acting user. In environments where the Token...

The vulnerability of Adobe Audition’s audio editor, related to reading data beyond the buffer in memory, allows a hacker to gain unauthorized access to protected information.

The vulnerability of Adobe Audition is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

The vulnerability of the Microsoft .NET software platform and the Visual Studio Code editor, related to errors in handling symbolic links, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Microsoft .NET software platform and the code editor Visual Studio Code is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

ROS-20260722-73-0023

The vulnerability of the MHTML component in Google Chrome and Microsoft Edge is related to the manipulation of inter-site requests. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information remotely...

ROS-20260722-73-0007

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

PT-2026-63426

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure...

The vulnerability of the Adobe Experience Manager content and media data management system lies in the lack of authentication for a critical function. This allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the Adobe Media Encoder application relates to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms and gain unauthorized access to protected information...

CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63262

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

CVE-2026-63145

Kibana Machine Learning (ML) functionality is affected by an Incorrect Authorization (CWE-863) vulnerability. A management endpoint performs only a coarse privilege check and does not verify that the requesting user has access to the specific ML job or notification resources referenced in the req...