CVE-2026-54178: Improper Limitation of a Pathname to a Restricted Directory

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts...

Important: libvirt

Issue Overview: A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can...

PT-2026-91528

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7 iPadOS versions prior to 26.7 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 tvOS versions prior to...

PT-2026-91697

Name of the Vulnerable Software and Affected Versions Safari versions prior to 27 iOS versions prior to 26.7 iPadOS versions prior to 26.7 macOS Golden Gate versions prior to 27 visionOS versions prior to 27 Description An app may be able to access sensitive user data due to insufficient...

PT-2026-91721

Name of the Vulnerable Software and Affected Versions IBM i Access Family versions 1.1.2.0 through 1.1.9.15 Description IBM i Access Client Solutions contains an issue where improper validation of user-supplied input in the STRPCCMD CL command allows an authenticated user to execute arbitrary...

EUVD-2023-60686

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions userLogout, confirmUser, refuseUser, and resendUserConfirmation for any frontend user in the system...

CVE-2026-84556: Improper Authorization

An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

CVE-2026-76081: Off-by-one Error

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

PT-2026-91540

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

EUVD-2023-60634

An issue was discovered in twilioajaxhandler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability...

ROS-20260914-73-0080

The vulnerability of the Paint component in Google Chrome and Microsoft Edge browsers relates to the ability to bypass authentication by using a user-controlled password. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially created HTML page...

PT-2026-91175

Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information email address...

PT-2026-91472

Name of the Vulnerable Software and Affected Versions macOS versions prior to Golden Gate 27 Description An application may be able to access sensitive user data due to improper state management. State management refers to the process of maintaining the current status of an application or system ...

PT-2026-91126

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

PT-2026-91067

Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

PT-2026-91520

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7 iPadOS versions prior to 26.7 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 Description A...

PT-2026-91068

Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed...

PT-2026-91071

Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

EUVD-2023-60685

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...

CVE-2026-64756: Improper Limitation of a Pathname to a Restricted Directory

A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data...