88768 matches found
CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...
CVE-2026-103283
Ghost versions 6.20.0 before 6.57.1 are affected by a session handling vulnerability. This flaw allows authenticated staff users to log in as any other staff member by providing only a password, effectively bypassing two-factor authentication . Attackers with valid staff credentials can exploit t...
CVE-2026-103265
Fleet versions before 4.89.0 are vulnerable to an information disclosure flaw in the commands/results endpoint. The root cause is a failure to properly filter MDM command results by team authorization. Consequently, team-scoped users can access MDM command results for hosts belonging to other tea...
BIT-RABBITMQ-2026-67226 RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits 3-4M short tag strings. An administrator can...
EUVD-2026-90579
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...
PT-2026-103748
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description Missing authorization allows authenticated users to add themselves to project teams, which enables them to access restricted issues. Recommendations Update to version 2026.2.19422...
CVE-2026-103291: Server-Side Request Forgery (SSRF)
Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...
CVE-2026-103286: Incorrect Privilege Assignment
Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated...
AlmaLinux 9.2 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.2:CLSA-2025:1751143797)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751143797 advisory. - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper...
PT-2026-105174
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits 3-4M short tag strings. An administrator can...
PT-2026-103692
Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher...
CVE-2026-103290: Path Traversal: '.../...//'
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...
Rocky Linux 9 [CIQ] Security Update: bpftrace / bpftrace-debuginfo / bpftrace-debugsource (crlsa-2024_9188)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249188 advisory. bpftrace: unprivileged users can force loading of compromised linux headers CVE-2024-2313 Tenable has extracted the preceding description block directly from the CI...
rsync: rsync: Authorization bypass via `auth users` directive parsing
An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...
CVE-2026-102106
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
CVE-2026-102106 Kiteworks Email Protection Gateway improper authentication
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
CVE-2026-100276
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...
CVE-2026-100258
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings...