October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only.
CVE-2026-22566 is an improper access control vulnerability in Ubiquiti Inc's UniFi Play PowerAmp and UniFi Play Audio Port products. A malicious actor with access to the UniFi Play network could exploit this flaw to obtain WiFi credentials. The vulnerability affects UniFi Play PowerAmp versions 1.0.35 and earlier, and UniFi Play Audio Port versions 1.0.24 and earlier. Updates to UniFi Play PowerAmp version 1.0.38 or later and UniFi Play Audio Port version 1.
CVE-2026-22564 is a critical Improper Access Control vulnerability in Ubiquiti Inc's UniFi Play PowerAmp and UniFi Play Audio Port products. It allows a malicious actor with network access to enable SSH and make unauthorized system changes. The vulnerability affects UniFi Play PowerAmp versions 1.0.35 and earlier, and UniFi Play Audio Port versions 1.0.24 and earlier. A fix is available by updating to UniFi Play PowerAmp version 1.0.38 or later and UniFi Play Audio Port version 1.
CVE-2026-21014 is an improper access control vulnerability in Samsung Camera versions prior to 16.5.00.28. It allows a local attacker with limited privileges to access location data. Exploitation requires user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.1.
CVE-2026-21006 is a medium severity vulnerability in Samsung DeX on Samsung Mobile Devices prior to the SMR Apr-2026 Release 1. It involves improper access control that allows physical attackers to access hidden notification contents. The vulnerability does not require user interaction or privileges and has a low attack complexity. No official patch or remediation level is currently confirmed from the vendor advisory. There are no known exploits in the wild at this time.
CVE-2026-34860 is an access control vulnerability in the memo module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. Successful exploitation can lead to impacts on system availability and confidentiality. The vulnerability has a medium severity with a CVSS score of 4.1. There is no information currently available about patches or official remediation. No known exploits in the wild have been reported.
FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify that the requested application belongs to the authenticated team. This leads to cross-tenant data exposure and unauthorized execution of private AI workflows. This vulnerability is fixed in 4.14.10.4.
CVE-2026-35533 is a high-severity improper access control vulnerability in jdx mise versions 2026.2.18 through 2026.4.5. The issue arises because mise loads trust-control settings from a local . mise.toml file before performing trust checks. An attacker able to place a malicious . mise.
### Summary
The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser.
### Impact
Only apps that match the following conditions are affected:
- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))
- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)
- the sensitive file is denied with a pattern that matches a file by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)
### Details
On the Vite dev server, files that should be blocked by `server.fs.deny` (e.g., `.env`, `*.crt`) can be retrieved with HTTP 200 responses when query parameters such as `?raw`, `?import&raw`, or `?import&url&inline` are appended.
### PoC
1. Start the dev server: `pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort`
2. Confirm that `server.fs.deny` is enforced (expect 403): `curl -i http://127.0.0.1:5175/src/.env | head -n 20`
<img width="3944" height="1092" alt="image" src="https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f" />
3. Confirm that the same files can be retrieved with query parameters (expect 200):
<img width="2014" height="373" alt="image" src="https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8" />
ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.
CVE-2026-1079 is a medium severity vulnerability in the Pega Browser Extension (PBE) used by Pega Robotic Automation. It involves improper access control in the native messaging host component, allowing a malicious website to trigger an unexpected message box if a user visits it. This vulnerability requires user interaction (navigating to the malicious site) and does not involve privilege requirements or confidentiality/integrity/availability impacts beyond the message box behavior. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-1078 is a high-severity arbitrary file-write vulnerability in Pegasystems Pega Robot Studio affecting versions 22.1 and R25. It involves the Pega Browser Extension used with Google Chrome or Microsoft Edge during robotic automation tasks. An attacker can exploit this vulnerability by luring a Robot Runtime user to a malicious website, potentially causing unauthorized file writes. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.
CVE-2026-1114 is a critical vulnerability in parisneo/lollms version 2.1.0 caused by improper access control due to a weak secret key used for signing JSON Web Tokens (JWT). This weakness allows an attacker to perform an offline brute-force attack to recover the secret key. With the recovered key, attackers can forge administrative tokens, enabling unauthorized privilege escalation and access to restricted endpoints. The vulnerability is fixed in version 2.2.0.
CVE-2026-35185 is a high-severity improper access control vulnerability in haxtheweb's HAXiam product prior to version 25.0.0. The /server-status endpoint is publicly accessible without authentication, exposing sensitive information such as authentication tokens, user activity, client IP addresses, and server configuration details. This exposure allows unauthenticated users to monitor real-time user interactions and gather internal infrastructure information. The vulnerability is fixed in version 25.0.0.
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.
SignalK Server versions prior to 2.24.0-beta.1 have an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities without authentication or authorization. This vulnerability enables attackers to control which GPS, AIS, or sensor data sources the system trusts. Changes made via this endpoint are applied immediately and persist across server restarts. The issue has been patched in version 2.24.0-beta.1.
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.