93 matches found
CLEANSTART-2026-YK34202 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check
CVE-2026-59739 affects multiple packages. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. See references for individual vulnerability details...
CLEANSTART-2026-JM28284 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check
Security vulnerability affects the spark package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...
CVE-2026-92226 Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...
CVE-2026-92223
The Joomla! Core software is affected by an improper access check vulnerability in versions 5.0.0-5.4.8 and 6.0.0-6.1.3 . This flaw allows unauthorized users to bypass Access Control Lists (ACL) to update the workflow stage of contents that are otherwise inaccessible to them. No specific exploit ...
EUVD-2026-89077
Joomla! Core - 20260910 - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents...
CVE-2026-90917
The Joomla! Core component is vulnerable to an improper access check in the outputs for tagged items. This flaw allows unauthorized users to view content items that are located within inaccessible categories across Joomla versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . No specific exploit details or remed...
CVE-2026-90913
The Joomla! Core component is affected by an improper access check affecting webservice endpoints in versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . This vulnerability allows unauthorized users to perform mutation actions on specific access level endpoints. No specific exploit details or remediation versi...
CVE-2026-90913 Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260903 - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints...
CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check
Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...
PT-2026-102693
Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description An improper Access Control List ACL check occurs in the outputs for tagged items. This flaw allows unauthorized users to view content items that...
PT-2026-102689
Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description Improper Access Control List ACL checks in webservice endpoints allow unauthorized users to perform mutation actions. ACL is a mechanism used to...
PT-2026-102699
Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description Improper Access Control List ACL checks for various webservice edit tasks allow unauthorized users to perform edit actions on items that should...
Linux Distros Unpatched Vulnerability : CVE-2026-59739
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registerin...
CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...
CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...
CVE-2026-59739: Missing Authorization
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...
PT-2026-93406
Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.9.6 Apache ZooKeeper versions prior to 3.8.7 Description An information disclosure issue exists due to a missing Access Control List ACL check during the SetWatches reconnect replay. An attacker can discove...
CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...
CVE-2026-86451
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...