CVE-2026-13719

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface API to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is...

Exploit for CVE-2026-102971

CVE-2026-102971: hidden revision author ID disclosure Reporte...

CVE-2026-18783

The Trex MES software by Trex Digital Smart Manufacturing Systems Inc. is vulnerable to an Authentication Bypass due to missing server-side authentication on a REST API endpoint . This vulnerability allows unauthorized access to critical functions. The issue affects versions through 2026-09-29 . ...

CVE-2026-18783 Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES

Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29...

OESA-2026-4164 python-jupyter-server security update

The backend for Jupyter web applications Security Fixes: Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitra...

EUVD-2026-89950

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-76504

A critical authentication bypass vulnerability exists in the Cisco Catalyst SD-WAN Manager API session-based authentication management. The root cause is improper handling of URI encoding (CWE-177) in HTTP requests, allowing an unauthenticated, remote attacker to bypass authentication rules and g...

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

Incorrect Behavior Order

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Incorrect Behavior Order via...

wordpress_exploit

Vulnerable Lab: CVE-2026-63030 WordPress This environment r...

EUVD-2026-89778

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

CVE-2026-103012

The Claude Code application is vulnerable to a security flaw where it prioritizes locally stored API keys (from previous logins or configurations) over the server-managed settings of a valid Claude Enterprise or Team account. If the settings endpoint rejects the stored key, the session may start ...

Security Bulletin: IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844

Summary IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values durin...

CVE-2026-13720

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

CVE-2026-13719

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

CVE-2026-13719

In Grafana , an authenticated user can exploit a vulnerability in the alert rules API list endpoint to access alert rules in folders they are unauthorized to read. This occurs because folder restrictions are dropped when a user's permitted folder set is empty, potentially returning every alert ru...

CVE-2026-13719

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...