CVE-2026-18659

A flaw was found in Eclipse Jetty. A remote attacker can bypass security constraints by sending HTTP requests containing substrings of configured HTTP methods when method omission rules are used. This issue allows unauthorized users to access protected resources and endpoints that should be...

CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

CVE-2026-111445

The Wheels framework versions 4.0.0 through 4.1.2 (before 4.2.0 ) is vulnerable to a flaw where incoming scope conditions are replaced with a primary-key condition in findByKey() and exists(key=) . Specifically, in exists(key=) , if production error information is disabled, the system may return ...

Atlassian Confluence Server - Local File Inclusion

Atlassian Confluence Server allows remote attackers to view restricted resources via local file inclusion in the /s/ endpoint. id: CVE-2021-26085 info: name: Atlassian Confluence Server - Local File Inclusion author: princechaddha severity: medium description: Atlassian Confluence Server allows...

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset

strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. id: CVE-2019-18818 info: name: strapi CMS 3.0.0-beta.17.5 - Admin Password Reset...

ElasticSearch <1.6.1 - Local File Inclusion

ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. id: CVE-2015-5531 info: name: ElasticSearch 1.6.1 - Local File Inclusion author: princechaddha severity: medium description: ElasticSearch before 1.6.1 allows remote...

EUVD-2026-102535

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access...

EUVD-2026-102504

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to...

PT-2026-115500

Name of the Vulnerable Software and Affected Versions Wp Map Block versions prior to 3.0.1 Description The software contains a flaw allowing unauthorized data modification due to missing capability checks within the set status and bulk functions of the Maps Controller REST controller. The can edi...

UBUNTU-CVE-2026-110924

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...

CVE-2026-110924

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...

PT-2026-116099

🚨 CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en US/eql, escaping the unsanitized...

PT-2026-116151

Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are...

CVE-2026-85985: Missing Authorization

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

Red Hat: CVE-2026-85985: mariadb: MariaDB: Unauthorized file access via CONNECT engine functions

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

PT-2026-115507

Name of the Vulnerable Software and Affected Versions Mattermost version 11.10.0 Mattermost versions 11.7.x through 11.7.9 Mattermost versions 11.9.x through 11.9.1 Mattermost versions 11.8.x through 11.8.5 Description An issue exists where the system fails to validate the invited recipient's ema...

PT-2026-116164

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 2.11.0 Description An authorization inconsistency exists in the AuthMiddleware.managerAuth function. When a request uses a valid environment access token via the X-Arcane-Agent-Token header, the system installs an...

Wazuh wm_agent_upgrade Unauthorized Access

The vulnerability of the wmagentupgrade component in the Wazuh security monitoring and threat detection platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected informatio...

Microsoft PowerShell 7.4.x < 7.4.21 / 7.5.x < 7.5.12 / 7.6.x < 7.6.7 Multiple Vulnerabilities (October 2026)

The version of Microsoft PowerShell installed on the remote host is 7.4.x prior to 7.4.21, 7.5.x prior to 7.5.12, or 7.6.x prior to 7.6.7. It is, therefore, affected by multiple vulnerabilities: - Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized...

Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_83460)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683460 advisory. ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in...