CVE-2026-56608

HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization...

CVE-2026-56608 HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).

HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization...

CVE-2026-69082

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-67295

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability allows a malicious RDP server to bypass security checks during drive redirection. By sending specially crafted paths, the server can access, read, write, delete, and list files in...

CVE-2026-33591 Authentication bypass on WaptServer

A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account...

CVE-2026-9593

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-28147

The CVE-2026-28147 entry concerns a Missing Authorization vulnerability in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates). Affected versions are up to 2.0.15; the issue is described as broken/incorrectly configured access control that could allow unauthori...

EUVD-2026-52188

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-9593

The CVE-2026-9593 entry describes a vulnerability in the iDTM FDI where an attacker with elevated privileges on the host can enable the debug interface by placing a crafted file in the application directory. This could lead to unauthorized access to connected devices and exposure, modification, o...

CVE-2026-9593 iDTM FDI Unauthorized Debug Interface Enablement

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

EUVD-2026-52175

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data including the email...

CVE-2026-16274 Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

mariadb: mbstream: Unauthorized file creation via path traversal

A flaw was found in MariaDB's mbstream utility. This vulnerability allows a highly privileged local attacker, who can provide a specially crafted archive, to create files outside of the intended target directory. This is due to mbstream not properly validating paths containing directory traversal...

PT-2026-67462

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized acces...

PT-2026-67457

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

The vulnerability of the JIT-compiler of Mozilla Firefox allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the JIT-compiler of Mozilla Firefox relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypa...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-18570

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates...