FastapiAdmin versions through 3.0 have an authentication bypass vulnerability (CVE-2026-111641) that allows unauthenticated attackers to obtain sessions for any user. Attackers can abuse unprotected auto-login endpoints to list users, mint a superuser auto-login token, and exchange it for a JWT session, gaining full administrative control. The vulnerability has a critical CVSS score of 9.8.
Aureus ERP versions up to 1.6.0 have an authorization bypass vulnerability that permits authenticated API users to create or move records into companies they should not have access to by supplying a foreign company_id. This flaw affects multi-company data segregation by allowing unauthorized data manipulation through plugin REST API endpoints such as partners, sales, or inventories.
IoTSharp versions through 3.6.1 have an insecure direct object reference vulnerability that allows any authenticated user to access data belonging to other tenants. This occurs because the Customers and Devices API handlers do not properly restrict queries to the authenticated user's tenant. Attackers can self-register via an anonymous endpoint and supply other tenants' identifiers to read sensitive customer and device information.
Helical Insight versions through 7.0.0 have a path traversal vulnerability that allows authenticated users to read files outside the intended solution directory. This occurs via the path parameter of the /getExternalResource endpoint, where attackers can use parent-directory segments to access readable files with certain extensions like js, json, or html. The vulnerability bypasses per-resource access control, potentially exposing sensitive files.
HestiaCP versions before 1.10.5 have an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions by impersonating the protected ROOT_USER account. This occurs because the read-only flag is not checked when using the loginas parameter to POST to /add/cron/, enabling attackers to run commands as the protected administrator's system account.
Helical Insight versions through 7.0.0 have an SQL injection vulnerability that allows authenticated users to inject SQL via unescaped report parameters sent to the /executeDatasource endpoint. This flaw permits attackers to bypass the SQL detection mechanism and potentially read or modify data in the report's data source.
O2OA versions up to 10.0.2-ce have an authorization bypass vulnerability in the x_processplatform_assemble_surface component. Authenticated users can exploit this flaw to download attachments from other users' works by supplying any attachment UUID without proper ownership verification. This issue arises because the functions ActionDownloadWithWork and ActionDownloadWithWorkStream do not verify that the requested attachment ID belongs to the referenced work or draft. The vulnerability allows unauthorized reading of documents attached to other users' processes.
PlayEdu versions through 2.3 have a missing authorization vulnerability in the CourseController. This flaw allows authenticated students to bypass department visibility checks and access courses restricted to other departments. Attackers can enumerate sequential course and attachment IDs via course details and attachment download endpoints to retrieve course structures and files from unauthorized departments. The vulnerability has a CVSS score of 4.3, indicating medium severity.
A vulnerability in GStreamer gst-plugins-good before version 1.28.2 allows an attacker to disclose heap memory contents. The issue occurs in the isomp4 plugin's qtdemux_parse_uuid function when parsing MP4 files, due to reading past the end of a heap-allocated buffer.
A vulnerability in GStreamer gst-plugins-good before version 1.28.2 allows the isomp4 plugin's qtdemux_parse_chnl function to read past the end of a global array when parsing MP4 files. This can lead to information disclosure. The issue is identified as CWE-125 (Out-of-bounds Read) and has a CVSS 3.1 score of 7.5 (high severity). No patch information is provided in the input data.
A buffer overflow vulnerability exists in WEINVEIW CO.,LTD EBPro version 6.10.01.510_20251022 within the UtilityManagerEx.exe component. This flaw allows a remote attacker to execute arbitrary code on the affected system. No CVSS score or patch information is currently available.
A vulnerability in libblockdev allows unprivileged local users to pass specially crafted label values starting with a dash to the ntfslabel and fatlabel utilities via the bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions. This occurs because these functions do not use end-of-options separators or validate input, causing the label to be interpreted as command-line flags. The flaw is reachable through the udisks2 Filesystem.SetLabel() D-Bus method without requiring administrator authentication. The issue has a low severity score and no known exploits in the wild.
Openwave Webtop Media Transcoder versions before 1.1.22.0 do not enforce administrator-defined file type restrictions for file conversions. This allows authenticated users to convert file types beyond those intended by administrators, potentially leading to unintended processing of documents. The vulnerability has a medium severity with a CVSS score of 4.3 and does not impact confidentiality or integrity but may affect availability.
CVE-2026-85977 is a vulnerability in libtirpc affecting client applications that use the pmap_getmaps() function. A remote attacker can send specially crafted PMAPPROC_DUMP replies causing unbounded decoding, which leads to excessive memory and CPU usage. This results in a denial of service (DoS) due to resource exhaustion of the client process. Exploitation requires interaction with an attacker-controlled or spoofed portmapper service and user interaction, limiting broad applicability. Red Hat has released updated libtirpc packages to address this issue.
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
Cisco NX-OS Software for Nexus 3000 and 9000 Series Switches contains a critical remote code execution vulnerability (CVE-2026-76471) in the NX-API feature. This flaw allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending crafted HTTP requests. The NX-API feature is disabled by default on Nexus switches but enabled by default on UCS 6300 Series Fabric Interconnects through the UCS Manager XML API, which requires low-privileged user credentials. Cisco has released software updates to address this vulnerability, and no workarounds are available. Cisco also provides a temporary Live Protect shield mitigation. There are additional related vulnerabilities affecting Nexus switches disclosed in separate advisories. No public exploitation is known at this time.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability in the Digital Certificate Manager (DCM) for System TLS related to improper locking (CWE-667). This flaw can be exploited by applications attempting to create secure network connections to cause a denial of service, potentially preventing a service from starting or forcing it to fallback to non-secure connections. The vulnerability has a CVSS score of 5.1, indicating medium severity.
Unit 42's report for September 2026 outlines the top five initial access vectors used by adversaries to breach organizations. The primary vector is exploitation of public-facing applications, followed by credential abuse, phishing, supply chain compromise, and drive-by compromises. These vectors highlight a mix of technical exploits and social engineering targeting public sector, critical infrastructure, and enterprise environments. The report emphasizes the systemic risks posed by supply chain attacks and automated drive-by compromises. No specific vulnerabilities or exploits are detailed, but the trends indicate persistent threats leveraging exposed infrastructure and stolen credentials.
CVE-2026-89098 is a vulnerability in the nfs-utils package on Red Hat Enterprise Linux 10 where the fsidd daemon improperly handles malformed input on its local domain socket, triggering an assertion failure. This causes the daemon to crash, resulting in a denial of service for filesystem identifier lookup services until the service is restarted. The vulnerability requires local authenticated user access and does not impact confidentiality or integrity. The fsidd service is not enabled by default and is only used in specific NFS re-export configurations, limiting the scope of impact.