CVE-2026-76719

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions...

EUVD-2026-88698

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions...

CVE-2026-76718 HPE OneView - Cross-site scripting vulnerability

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions...

EUVD-2026-88693

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions...

CVE-2026-8066

A directory traversal vulnerability exists in the file upload functionality of the Hitachi Energy RTU500 . This flaw allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Successful exploitation may lead to the unauthorized modification of device data...

BIT-OPENBAO-2026-71543 OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter pa...

EUVD-2026-88663

Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...

CVE-2026-86157

Progress Telerik Fiddler Everywhere versions prior to 8.2.0 are vulnerable to the exposure of privileged IPC functionality . A local, low-privileged attacker who can modify application launch parameters and influence a user to start the application can replace the UI or settings with attacker-con...

OpenAI Shelves GPT-6.1 Astra After Tests Find Deception and Unauthorized Actions

OpenAI on Monday shelved plans to release GPT-6.1 Astra, a next-generation artificial intelligence AI model that was planned for an October launch, after it failed internal safety and alignment audits. The development was first reported by The Wall Street Journal. The move "marks a rare case of a...

CVE-2026-97559

A flaw was found in the Linux kernel's SMB client. An integer overflow during Discretionary Access Control List DACL reconstruction can allow a local user to corrupt file access permissions sent to a remote server. When processing file permission or ownership updates with numerous access control...

CVE-2026-93758

A flaw was found in Mongoid. An authenticated remote attacker with basic application privileges could exploit an insecure direct object reference in the nested attributes handling. This vulnerability allows the attacker to reference and manipulate record identifiers belonging to other users,...

EUVD-2026-88597

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

EUVD-2026-88560

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...

PT-2026-102613

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

PT-2026-102874

An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication...

PT-2026-102699

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description Improper Access Control List ACL checks for various webservice edit tasks allow unauthorized users to perform edit actions on items that should...

PT-2026-102743

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter pa...

Linux Distros Unpatched Vulnerability : CVE-2026-53626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document...

PT-2026-102704

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description An issue exists where the public removeTmpAttachment action allows the deletion of database rows and files by accepting an integer attachment ID. While the controller verifies a Joomla sessio...

PT-2026-102692

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description An improper Access Control List ACL check in the content history comparison view allows unauthorized users to view content that should be...