CVE-2026-72786

Craft CMS versions before 5.10.8 are vulnerable to an authentication bypass in the elements/save action. The root cause is an unprotected newPassword field in the User element save flow, which can be exploited by authenticated users with edit users permission to reset any user’s password (includi...

CVE-2026-72786 Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

CVE-2026-72786

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

EUVD-2026-57446

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

CVE-2026-73303

Budibase vulnerability CVE-2026-73303: An IDOR in the Email Change flow existed prior to 3.40.0 where POST /api/v2/email accepted a client-controlled accountId without binding it to the authenticated session, validating only currentEmail. An attacker who knew a victim’s accountId could initiate t...

CVE-2026-73303

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can...

CVE-2026-49467

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

CVE-2026-17268

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token...

[SECURITY] [DSA 6434-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6434-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 12, 2026 https://www.debian.org/security/faq -...

DRUPAL-CONTRIB-2026-098

This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This...

EUVD-2026-57388

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

CVE-2026-42018 Anonymous user token generation exposure in JFrog Artifactory

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

CVE-2026-17268

IBM i (versions 7.6, 7.5, 7.4, 7.3) is affected by CVE-2026-17268 in Navigator for i, which could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token. The issue is documented in IBM’s Security Bulletin and tied to a CVSS v3.1 base sc...

EUVD-2026-57362

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token...

CVE-2026-17268

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token...

CVE-2026-17268 IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token...

CVE-2026-18713

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands...

CVE-2026-17095

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...

K000162893: Spring Web Services vulnerability CVE-2026-40995

Security Advisory Description X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks disabled, locked, expired, or credentials-expired accounts...

CVE-2026-49467 TOTP enrollment hijack: password gate skipped due to unawaited promise

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...