CVE-2026-86494

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86493

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...

CVE-2026-86494

In JetBrains YouTrack versions prior to 2026.2.18634 , cloning a whiteboard allowed an attacker with low privileges to make unauthorized changes to links on issues they could not otherwise access. The vulnerability is rated CVSS 7.7 (High) with changed scope and high integrity impact , requiring ...

EUVD-2026-72509

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...

EUVD-2026-72510

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86487

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

CVE-2026-86487

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

CVE-2026-86482

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation...

CVE-2026-86481

JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in which signed URL reuse allowed disclosure of restricted project icons . The underlying cause is the reuse of signed URLs, enabling an authenticated low-privilege user to access project icon resources that should re...

OPENSUSE-SU-2026:21801-1 Security update for trivy

This update for trivy fixes the following issues: - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates bsc1258543. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP meth...

AZL-99977 CVE-2026-76560 affecting package 389-ds-base 3.1.1-12

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-76560

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

DEBIAN-CVE-2026-76560

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

Security update for amazon-cloudwatch-agent

This update for amazon-cloudwatch-agent fixes the following issues: CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control bsc1277995. CVE-2026-41178:...

SUSE-SU-2026:4045-1 Security update for amazon-cloudwatch-agent

This update for amazon-cloudwatch-agent fixes the following issues: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control bsc1277995. -...

WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peng Zhou in WordPress Plugin Csomagpontok és szállítási címkék WooCommerce-hez versions 4.2.8...

WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Unbounce Landing Pages versions = 1.1.4...

CVE-2026-86451

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86418

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID;...

UBUNTU-CVE-2026-76578

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...