An Incorrect Authorization vulnerability in the Drupal Webform module allows forceful browsing, potentially exposing information without proper access control. This affects Webform versions from 0.0.0 up to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.3.
An incorrect authorization vulnerability exists in the Drupal Mermaid Diagram Field module versions 1.0.4 through 1.0.9. This flaw allows forceful browsing, potentially enabling users with limited privileges to access unauthorized resources. The vulnerability has a low severity rating with a CVSS score of 3.5.
An authentication bypass vulnerability exists in Drupal REST & JSON API Authentication versions up to 3.2.0. This flaw allows attackers to bypass authentication by using an alternate path or channel. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with low complexity and no user interaction required.
CVE-2026-96387 is an authentication bypass vulnerability in the Drupal Stop administrator login module affecting versions 1.0 through 1.5. The flaw allows an attacker with high privileges to bypass authentication using an alternate path or channel. The vulnerability has a low severity rating with a CVSS score of 3.8. A fix is available in version 1.6.
A missing authorization vulnerability in the Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) allows unauthorized users to perform forceful browsing, potentially exposing sensitive information. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. There is no indication of available patches or vendor advisories at this time.
CVE-2026-96386 is a missing authorization vulnerability in the Drupal Smart Content module that allows unauthorized users to perform forceful browsing. This affects Smart Content versions from 0.0.0 up to but not including 3.2.1. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 3.2.1.
A vulnerability in Roundcube involves unsafe use of a login name in the SquirrelMail import file path, potentially allowing unauthorized access to sensitive data. The issue affects multiple specific versions of Roundcube. The CVSS score is 5.3, indicating a medium severity vulnerability with network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.
CVE-2026-114715 is an incorrect authorization vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The flaw exists in the Modoboa driver of the password plugin, where the driver incorrectly uses the first account returned by the Modoboa API instead of verifying the authenticated user's account. This could allow a password change to be applied to a different user account.
Multiple security issues affecting the MozillaThunderbird package on openSUSE Tumbleweed have been fixed in version 153.5.1-1.1. These issues collectively represent a medium severity risk. The update addresses a range of vulnerabilities bundled in this package release.
A security update for the Linux kernel addresses multiple vulnerabilities including a NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063). The update also fixes other kernel-related security issues and bugs. The affected kernel versions are those prior to 5.14.0-687.60.1.el9_8. Red Hat has released a patch that must be applied and requires a system reboot. The update is rated as having an Important security impact by Red Hat.
CVE-2026-114574 is an information disclosure vulnerability in massCodeIO massCode version 5.10. The flaw exists in an unspecified function within the Local HTTP Service component, specifically in the file src/main/api/index.ts. This vulnerability can be exploited remotely without privileges or user interaction. Public exploit code has been disclosed. A patch identified by commit d25d8fa3f5a1e34285c8634f18729650c0c05cda is available to address the issue.
CVE-2026-12664 is an authorization vulnerability in GitLab CE/EE versions from 18.2 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It allows an authenticated user with a read_api-scoped token to bypass scope restrictions and retrieve a project's incoming email address and create work items due to insufficient scope enforcement on a GraphQL field. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-14288 is a vulnerability in GitLab Enterprise Edition affecting versions from 17.4 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1. It allows an authenticated user to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-16255 is an authorization vulnerability in GitLab EE affecting versions from 12.0 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. When the instance-wide SAML or LDAP membership lock was enabled, authenticated users could grant or accept project and group memberships outside the identity provider's control due to incomplete enforcement of the membership lock on pre-existing requests. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-103515 is an authorization vulnerability in GitLab Enterprise Edition affecting versions 19.2 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1. The flaw allowed an authenticated user with group Owner permissions to re-enable AI-backed data egress to a third-party service for a group and its descendant projects, even when an instance administrator had locked the group's Duo availability. This was due to insufficient granularity in the enforcement of admin-lock controls. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112378 is a vulnerability in GitLab EE versions from 17.8 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It involves insufficient server-side validation in billing eligibility checks, which could allow an authenticated user to access paid AI features without a valid subscription. GitLab has fixed this issue in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112212 is a high-severity vulnerability in GitLab CE/EE versions from 18.3 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It involves HTTP request/response smuggling where an unauthenticated attacker could poison a shared cache's OAuth/OIDC discovery document. This could redirect certain authentication flows to an attacker-controlled server due to improper trust of user-supplied values in cached discovery responses. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112326 is a vulnerability in GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. It involves improper cleanup on thrown exceptions that could allow an authenticated user with read-only permissions to permanently delete existing vulnerability records. This occurs due to flawed error handling logic that fails to differentiate between pre-existing and newly created records. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-89052 is a vulnerability in the TP-Link Archer C6 V2 router involving the use of a hardcoded cryptographic key shared universally across devices. This flaw allows attackers who obtain encrypted configuration files or protected credential data to recover plaintext credentials, exposing sensitive administrative information. The vulnerability has a medium severity with a CVSS 4.0 score of 5.9. A fix is available in version 1.2.1 Build 260902.