RuoYi-Vue-Plus versions up to 6.0.0 have an authorization bypass vulnerability in the SysUserServiceImpl.selectUserListByDept function. Authenticated users with the system:user:list permission under a department-restricted role can access user information from any department by specifying arbitrary department IDs. This allows them to retrieve usernames, nicknames, account status, last login IP and time, and remarks of users outside their authorized scope.
Open Web Analytics versions prior to 1.14.1 have an authorization bypass vulnerability that allows authenticated users with report viewing permissions on one site to access report data from other sites. This occurs because clickstream and transaction reports are not properly scoped to the authorized siteId, enabling users to supply another site's session_id or order_id to retrieve sensitive visit and order information.
ZenTao PMS versions up to 22.6 have an authorization bypass vulnerability in the doc::ajaxGetDoc() function. This flaw allows authenticated users with low privileges to access private document contents without proper access checks. Attackers can enumerate document IDs to read body and draft content of restricted documents across libraries, products, projects, or teams.
Blossom Editor versions up to 1.17.1 have an authorization bypass vulnerability allowing authenticated users with non-readonly privileges to manipulate other users' pictures by specifying arbitrary picture IDs. This flaw enables attackers to delete images or change their star status via specific endpoints.
CVE-2026-119680 is a stored cross-site scripting (XSS) vulnerability in ManageEngine SharePoint Manager Plus affecting the chart feature. It arises from improper sanitization and HTML encoding of user-controlled data such as users' full names, site names, or group names. Malicious HTML or JavaScript injected by an attacker is stored and executed in other users' browsers when viewing affected charts. The vulnerability has been fixed in client application build 4508.
CVE-2026-100355 is a server-side request forgery (SSRF) vulnerability in the basecamp once-campfire web-based chat application versions 1.4.4 and earlier. The vulnerability arises because the server fetches URLs in messages to generate OpenGraph previews, but the IP address filtering mechanism does not cover certain special-use IP ranges. This allows an authenticated user to bypass restrictions and cause the server to make requests to internal network resources. The confidentiality impact is limited to the OpenGraph metadata returned, with no integrity or availability impact. The issue was fixed in version 1.4.5.
The Kirki plugin for WordPress versions prior to 6.2.5 has a vulnerability that allows unauthenticated attackers to bypass the reCAPTCHA verification on frontend forms. By omitting the g-recaptcha-token field in POST requests, attackers can submit forms without valid verification, leading to unlimited form submissions and triggering notification emails, webhooks, and database writes without completing reCAPTCHA validation. This issue is fixed in version 6.2.5.
This analysis discusses the security implications of passkeys as a replacement for passwords. Passkeys improve authentication security by using cryptographic credentials that are phishing-resistant and not reusable, reducing risks like credential theft and phishing. However, passkeys do not eliminate broader identity risks such as compromised account enrollment, device changes, recovery processes, or session hijacking. Attackers may target these surrounding areas rather than the authenticator itself. Continuous identity threat detection is necessary to evaluate trust beyond the moment of authentication, addressing risks throughout the identity lifecycle.
Kirki plugin for WordPress versions before 6.4.1 has a broken object-level access control vulnerability in its REST API. This flaw allows users with the Editor role, who have Kirki edit access, to modify the title, slug, and publication status of any non-trashed post, including custom post types and WooCommerce products they do not own. The vulnerability arises because the plugin relies only on a coarse role-based check without verifying per-object WordPress capabilities. This can lead to unauthorized exposure or removal of content.
CVE-2026-119542 is a vulnerability in the Ickle query parser component of Infinispan used in the Red Hat build of Apache Camel 4 for Quarkus 3. It allows an authenticated user with BULK_READ permission to submit a cache query with deeply nested predicates that cause uncontrolled recursion, leading to a StackOverflowError and potential denial of service due to thread stack exhaustion.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving the use of a hard-coded cryptographic key. This flaw allows a low privileged attacker with local access to potentially disclose sensitive information. The vulnerability is identified as CWE-321 and has a high severity rating with a CVSS score of 7.3. The issue is fixed in version 4.8.0 and later.
A stack-based buffer overflow vulnerability exists in the GIMP PSD plug-in's image resource header loader. This flaw occurs due to an incorrect destination size used when copying a converted resource name into a fixed stack buffer. Opening a specially crafted PSD file can trigger this overflow, potentially causing a crash or arbitrary code execution in the context of the user running GIMP. Exploitation requires user interaction to open or parse a malicious PSD file. Mitigations include avoiding untrusted PSD files and removing the GIMP package if not needed.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS Command Injection vulnerability (CWE-78) that allows a low privileged remote attacker to execute arbitrary commands. This vulnerability is due to improper neutralization of special elements in OS commands. It is rated high severity with a CVSS score of 8.8. The issue is fixed in version 4.8.0 and later.
OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials.
This issue affects Vatos DLP: from 1.1.176 before 1.1.243.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 5.5. A fix is available in version 4.8.0 and later.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an authentication bypass vulnerability due to spoofing. This flaw allows an unauthenticated attacker with adjacent network access to potentially steal sessions. The vulnerability is fixed in version 4.8.0 and later.
The FBI seized the domain virtualine.net, used by Virtualine, a Russian-speaking bulletproof hosting provider that supported various cybercriminal activities including hack-for-hire services, ransomware, infostealers, phishing, spam, and carding. Despite law enforcement takedown requests, Virtualine continued aiding illicit customers and hosting illegal content. The provider received significant cryptocurrency payments linked to criminal operations such as drug marketplaces, sextortion schemes, and ransomware groups. Domain seizure disrupts access but does not guarantee cessation of the operator's activities or loss of infrastructure access.
Dell OpenManage Enterprise versions prior to 4.8.0 have a vulnerability where critical functionality lacks proper authentication. This flaw allows an unauthenticated attacker with adjacent network access to potentially perform server-side request forgery (SSRF). The vulnerability is identified as CWE-306 and has a medium severity rating with a CVSS score of 5.4. A fix is available starting from version 4.8.0.
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.
Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click.
If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host.
Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
Proof of concept: https://beford.net/poc/ssl_poc.html
Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.