CVE-2026-89103

The SAP Gateway is affected by a Broken Access Control vulnerability (CWE-863 ) where it activates a default Access Control List with high privileges. This allows an external attacker to be incorrectly categorized as an internal application server. An unauthenticated attacker with network access ...

PT-2026-141280

Name of the Vulnerable Software and Affected Versions SAP Gateway affected versions not specified Description SAP Gateway activates the default Access Control List with high privileges, which allows an external attacker to be categorized as an internal application server. An unauthenticated...

CVE-2026-49939

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right ...

EUVD-2026-118216

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right ...

CVE-2026-49939: Apache Software Foundation Apache James: In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol…

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right ...

CVE-2026-91085

A flaw was found in Apache Karaf. This vulnerability allows privilege escalation because the command access control list ACL mechanism permits unmatched commands by default, and no restriction is defined for the configuration installation command. An authenticated user with low privileges can...

CVE-2026-99110

A flaw was found in the Linux kernel's Common Internet File System CIFS client. When converting a POSIX Access Control List ACL to the network wire format, the kernel verifies the ACL against an extended attribute size calculation instead of the larger network format size, leading to a heap-based...

EUVD-2026-98689

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE SID length smbinheritdacl iterates over the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contains the fixed SID header prior to use, but fails to ensure...

Astra Linux – vulnerability in libarchive

An improper link resolution flaw during archive extraction can result in changes to the access control list ACL of the target of the link. An attacker can supply a malicious archive to a victim user, causing the flaw to be triggered when that user attempts to extract the archive. A local attacker...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix reference count leak in smbcheckpermdacl The issue occurs in a specific section of smbcheckpermdacl. When “id” and “uid” have the same value, the function simply jumps out of the loop without decrementing the reference...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. In versions prior to 8.0.3, as well as in 7.4.5, 7.2.10, and 6.2.19, an authenticated user could use a specially crafted string to trigger an out-of-bounds write operation on the hyperloglog data structure, potentially leadin...

Astra Linux – vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. An authenticated user with sufficient privileges can create a malformed ACL selector; upon access, this triggers a server panic followed by a denial of service. The issue affects Redis versions prior to 7.2.6 and 7.4.1. Users...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumacltcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a...

CVE-2026-77361

The obsidian-tc Model Context Protocol server (prior to version 1.3.1 ) contains a vulnerability where a mismatch between lexical vault-relative paths (used for ACL checks ) and resolved paths (used for containment checks) allows for ACL bypass . An attacker can use an out-of-band-planted symlink...

CVE-2026-107822

A flaw was found in MariaDB. An issue in the Access Control List ACL cache causes identical privilege cache keys to be generated when a role and a local user share the same name. An attacker with user creation privileges can exploit this key collision by creating a matching account, allowing them...

PT-2026-94024

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Adaptive Security Appliance ASA Software affected versions not specified Cisco Secure Firewall Threat Defense FTD Software affected versions not specified Description A logic error in the access control list ACL Object...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A integer overflow bug in the underlying string library can be exploited to corrupt the heap, potentially leading to denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-l...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A user with sufficient privileges can create a malformed ACL selector, which, when accessed, triggers a server panic and subsequent denial of service. This issue has been fixed in Redis 7.2.7 and 7.4.2...

Astra Linux – Vulnerability in Samba

A vulnerability was discovered in Samba. A delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object’s creation. This issue arises because the administrator...