CVE-2026-75007

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation...

CVE-2026-75002

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection...

EUVD-2026-60168

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection...

CVE-2026-75002

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection...

BIT-MONGODB-2026-13057 Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due t...

PT-2026-76762

Name of the Vulnerable Software and Affected Versions search-v2-operator affected versions not specified Description A flaw exists in the search-v2-operator where the search-serviceaccount is assigned overly broad permissions. This allows for the impersonation of users and groups across the entir...

CVE-2026-50770

An issue in Squirro Cognitive Search before version v.3.14.2 allows a remote attacker to escalate privileges by sending a crafted request. The vulnerability is characterized as a critical improper privilege management issue. While the documents confirm the existence of the vulnerability and its i...

CVE-2026-50772

An issue in Squirro Cognitive Search versions prior to 3.14.2 allows a remote attacker to achieve arbitrary code execution . This vulnerability is triggered by sending a crafted payload to the application's password reset function . The severity is rated as CRITICAL (CVSS 9.8) due to the potentia...

CVE-2026-50771

A Cross Site Scripting (XSS) vulnerability exists in Squirro Cognitive Search versions prior to 3.14.2 . This flaw allows a remote attacker to execute arbitrary code by interacting with the Email Notification , Create Evaluation Sets , and HTML Editor functions. While the description identifies t...

PT-2026-76695

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50770: Improper Privilege Management

An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request...

EUVD-2026-60356

An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request...

CVE-2026-50770

An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-71472: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-70495: Improper Privilege Management

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-75046: Missing Authorization

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

PT-2026-76656

Name of the Vulnerable Software and Affected Versions Dell ObjectScale versions prior to 4.3.0.1 Description An Uncontrolled Search Path Element issue exists where a low privileged attacker with local access could potentially exploit the flaw to achieve elevation of privileges. An uncontrolled...