CVE-2026-18639: Authentication Bypass by Spoofing

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

MAL-2026-13770 Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

EUVD-2026-55845

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917

AnythingLLM up to version 1.15.0 has an account-recovery weakness in the unauthenticated recovery flow (server/utils/PasswordRecovery/index.js). The code uses recoverAccount() to deduplicate recoveryCodes before trimming, allowing a valid code submitted twice with different surrounding whitespace...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18949

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account SA token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to...

CVE-2026-18617

A flaw was found in the Data Science Pipelines Operator DSPO. A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name DSN string. By manipulating these parameters, an attack...

CVE-2026-72910

CVE-2026-72910 affects ERPNext prior to versions 15.112.0 and 16.22.0. The issue arises because the functions merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center (across ERPNext code paths: erpnext/accounts/doctype/account/account.py, erpnext/account...

CVE-2026-72910 ERPNext: Unauthorised modification of master data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...

CVE-2026-72907

ERPNext contains a broken access control vulnerability in add_ac in erpnext/accounts/utils.py prior to versions 15.111.0 and 16.22.0, where ignore_permissions is not enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and co...

CVE-2026-72907

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...

CVE-2026-72907 ERPNext: Broken Access Control on certain endpoint

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...

CVE-2026-72907 ERPNext: Broken Access Control on certain endpoint

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...

CVE-2026-18620

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

EUVD-2026-55822

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...