PT-2026-64021

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto performs principal lookup without normalizing email and identifier strings. This lack of normalization allows for principal collision, which can lead to unauthorized account access when...

PT-2026-63798

Name of the Vulnerable Software and Affected Versions odh-dashboard affected versions not specified Description A flaw in the odh-dashboard web console component of Red Hat OpenShift AI RHOAI involves incorrect network binding. This allows a malicious actor within the cluster to bypass...

CVE-2026-64812: Missing Authentication for Critical Function

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64876: Cross-Site Request Forgery (CSRF)

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates...

PT-2026-63966

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description An issue exists where unauthorized input injection is possible during a Remote Development session. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

PT-2026-63606

Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates...

ROS-20260723-73-0048

The vulnerability in Chromium is related to the use of an unauthorized intermediate policy file. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

PT-2026-63968

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session...

PT-2026-63967

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description An issue exists in Remote Development sessions that allows for the unauthorized modification of settings. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

PT-2026-63954

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...

ROS-20260723-73-0052

The vulnerability in Chromium is related to the use of an unauthorized intermediate policy file. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

PT-2026-64198

Name of the Vulnerable Software and Affected Versions Pronetiqs IntraVUE versions 3.2.1a14 and earlier Description An exposure of sensitive system information to an unauthorized control sphere allows unauthenticated users to perform asset discovery. Recommendations Update Pronetiqs IntraVUE to a...

PT-2026-64206

Name of the Vulnerable Software and Affected Versions Microsoft Account affected versions not specified Description A heap-based buffer overflow occurs in Microsoft Account, which could allow an unauthorized attacker to execute arbitrary code over a network. A heap-based buffer overflow is a memo...

CVE-2026-64814: Missing Authorization

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session...

CVE-2026-15827: Missing Authorization

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are...

PT-2026-64020

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to enforce locally configured Multi-Factor Authentication MFA during Single Sign-On SSO authentication. This flaw allows users to bypass second-factor requirements, potentially...

PT-2026-64022

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDoma...

CVE-2026-64813: Client-Side Enforcement of Server-Side Security

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session...

PT-2026-64116

PraisonAI LinearBot processes unsigned webhooks when LINEAR WEBHOOK SECRET is missing Summary PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR WEBHOOK SECRET as optional. When the secret is absent, startup only logs a warning and handle webhook skips...

CVE-2026-15617: Improper Handling of Case Sensitivity

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...