Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...

CVE-2026-68758

Technical details about CVE-2026-68758 are not publicly available in the provided documents; no affected products, versions, root cause, or remediation are specified. Monitor for updates.

EUVD-2026-57255

A low-privileged authenticated user may access restricted support information under specific conditions...

CVE-2026-68758 Authenticated users may access restricted Artifactory support information

A low-privileged authenticated user may access restricted support information under specific conditions...

CVE-2026-66381 Repository readers may access content outside configured upstream paths

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

EUVD-2026-57250

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

CVE-2026-66379 Authenticated users may view private Puppet module metadata

An authenticated user may view private Puppet module metadata without repository read access...

CVE-2026-66380

CVE-2026-66380 describes a access control bypass where an authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. The public metrics indicate CVSS 3.1 base score 4.3 (Medium), with attack vector NETWORK and privileges required LOW,...

CVE-2026-66380 Authenticated users may access private OCI referrer metadata

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...

CVE-2026-68754 Publishers without delete permission can overwrite docker layer information

A repository publisher without delete permission may modify protected package content under specific conditions...

EUVD-2026-57243

A repository publisher without delete permission may modify protected package content under specific conditions...

EUVD-2026-57242

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way...

CVE-2026-66376 Deleted users may temporarily retain access to JFrog Artifactory

Credentials for a deleted user may remain valid for a short period under specific conditions...

CVE-2026-66376

This CVE (CVE-2026-66376) affects JFrog Artifactory and involves credentials for a deleted user remaining valid for a short period under certain conditions. The connected documents confirm the issue and its scope, but do not provide concrete technical details such as affected versions, specific c...

EUVD-2026-57240

A Project Resource Manager may gain broader administrative privileges under specific conditions...

EUVD-2026-57235

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...

CVE-2026-73290 RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...

EUVD-2026-57233

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

EUVD-2026-57230

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS getconditionvalues folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowin...

CVE-2026-73265

Vulnerability (CVE-2026-73265) : In RustFS, the GetObject/CopyObject/UploadPartCopy paths incorrectly authorize reads of historical versions using s3:GetObject instead of s3:GetObjectVersion, enabling principals without historical-version permissions to disclose known historical content. This aff...