CVE-2026-75882

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests...

PT-2026-133528

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...

PT-2026-121586

Name of the Vulnerable Software and Affected Versions AOS-10 affected versions not specified Description Buffer overflow issues in the affected interface allow an unauthenticated attacker to achieve remote code execution by sending specially crafted packets. A successful attack enables the...

PT-2026-121631

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A memory corruption issue exists that allows an authenticated local attacker to execute arbitrary code. Successful exploitation enables the attacker to run arbitrary code with privileged user...

CVE-2026-107506 Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and...

CVE-2026-107506 Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and...

CVE-2026-107506

The Simple Banner WordPress plugin, in versions prior to 3.3.3 , contains a privilege management flaw. The plugin fails to properly restrict the capabilities granted to user roles authorized by an administrator to manage banners. This oversight allows users with low-privileged roles to escalate t...

EUVD-2026-100573

Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user...

CVE-2026-103845 Dimension | Uncontrolled Search Path Element (CWE-427)

Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user...

EUVD-2026-100568

Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to...

CVE-2026-103846: Improper Neutralization of Input During Web Page Generation

Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation o...

CVE-2026-103847: Untrusted Search Path

Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to...

PT-2026-102865

Name of the Vulnerable Software and Affected Versions HPE Networking Instant ON affected versions not specified Description A buffer overflow occurs in the affected interface, which may allow an unauthenticated remote attacker to execute arbitrary code on the underlying host. Successful...

PT-2026-95350

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description An Administrative Session Concurrency issue exists where the application permits multiple simultaneous authenticated sessions for a single administrative account. This...

CVE-2026-75960

Rently Smart Home versions 20.1.0 and prior are affected by an Insufficiently Protected Credentials vulnerability that allows an attacker to retrieve PINs, including the Master Pin , thereby overriding standard user permissions. CISA rates this HIGH severity (CVSS 3.1: 8.1, CVSS 4.0: 8.7) with a ...

CVE-2026-75960 Insufficiently Protected Credentials in Rently Smart Home

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions...

CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-72909 ERPNext: Broken Access Control on certain endpoints

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...