CVE-2026-82860: Improper Privilege Management

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

BIT-GITLAB-2026-15831 Generation of Incorrect Security Tokens in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during tok...

CVE-2025-20346

CVE-2025-20346 describes a Cisco Catalyst Center RBAC vulnerability: an authenticated, remote attacker with at least Observer/read-only access can alter policy configurations that should be Administrator‑only. Affected product is Cisco Catalyst Center; exploitation involves logging in and modifyi...

Improper Authentication

Kyverno is vulnerable to Improper Authentication. The vulnerability is due to the ability to override a ClusterPolicy such as "disallow-privileged-containers" by creating a PolicyException in any namespace. This design flaw allows users with privileges in non-Kyverno namespaces to create...

March 28, 2023—KB5023774 (OS Build 22000.1761) Preview

None None...

SUSE CVE-2017-1000395

Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/username/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. The remote...