EUVD-2026-93928

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

CVE-2026-102407

A vulnerability in Elasticsearch (CWE-863) allows an authenticated user with sufficient privileges over a single resource to modify a data stream to which they are not authorized. By using the Modify Data Streams API , an attacker can potentially inject data or affect searchability, though they c...

CVE-2026-103504 Gitea API team demotion not applied to unit permissions

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

CVE-2026-103504 Gitea API team demotion not applied to unit permissions

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

CVE-2026-103504 Gitea API team demotion not applied to unit permissions

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

EUVD-2026-93914

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

CVE-2026-103504

The Gitea platform is vulnerable to a Least Privilege Violation (CWE-272) when updating organization team permissions via the API . Specifically, updating the permission field alone fails to rebuild per-unit access or apply the new level as a cap. Consequently, if an owner demotes a team (e.g., f...

CVE-2026-103667 Gitea container registry stored XSS through blob media type

Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...

CVE-2026-103667

The Gitea container registry is vulnerable to a stored XSS flaw because it serves blob downloads using a Content-Type derived directly from the media type in pushed image manifests. Due to the lack of a Content-Disposition header or a restrictive content security policy, an attacker with push pri...

CVE-2026-106513

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...

DEBIAN-CVE-2026-106422

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106422

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-103620

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-79818 Authentication Bypass in the API Interface Allows Unauthorized Information Disclosure in ClearPass Policy Manager

A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to obtain sensitive information from the affected system...

CVE-2026-79818 Authentication Bypass in the API Interface Allows Unauthorized Information Disclosure in ClearPass Policy Manager

A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to obtain sensitive information from the affected system...

CVE-2026-79818

A vulnerability exists in the API interface of ClearPass Policy Manager that allows an unauthenticated remote attacker to bypass existing authentication controls. Successful exploitation of this flaw could result in unauthorized information disclosure from the affected system. No specific patch v...

EUVD-2026-93904

A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to obtain sensitive information from the affected system...