CVE-2026-55445 - Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication

2026-07-15 Mittel

CVE-2026-55234 - Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)

2026-07-15 Mittel

CVE-2026-48795 - Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser

2026-07-15 Mittel

CVE-2026-56679 - 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

2026-07-15 Mittel

CVE-2026-62948 - OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

2026-07-15 Mittel

CVE-2026-59258 - immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

2026-07-15 Mittel