CVE-2026-77098

Commvault Private Metrics Server is affected by an SQL injection vulnerability affecting database operations, rated CVSS 3.1: 9.8 (CRITICAL) and CVSS 4.0: 8.8 (HIGH) . CISA SSVC assesses exploitation as "none," automatable as "yes," and technical impact as "partial." No public exploit details are...

EUVD-2026-72726

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...

PT-2026-87047

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...

CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

EEF-CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Summary Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action...

CVE-2026-82586

ash_lua (ash-project) is an Elixir library that exposes Ash resources to Lua scripts, with a manifest-gated allow-list controlling which fields scripts may read. The operation aggregate path in AshLua.Runtime resolved field names via String.to_existing_atom and Ash.Query.Aggregate.new! without co...

CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

CVE-2026-86489

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...

CVE-2026-86489

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...

EUVD-2026-72504

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches...

CVE-2026-86488

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches...

BIT-ELASTICSEARCH-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2026-58443

A flaw was found in Gitea. This vulnerability allows an attacker to use tokens intended for public repositories to modify private pull request PR branches. This could lead to unauthorized changes in private code, compromising the integrity of the affected repositories. Mitigation Update to Gitea...

MAL-2026-15936 Malicious code in trongridew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...

Malicious code in trongridew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86120

APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been...

CVE-2026-81348

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-81348 My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-81348

CVE-2026-81348 affects the My Private Site WordPress plugin in versions before 4.2.3 . The plugin fails to enforce its site-privacy access control on certain unauthenticated front-end read surfaces—specifically RSS feeds and the sitemap —allowing unauthenticated users to view post content, commen...