CVE-2026-94374: Authorization Bypass Through User-Controlled Key

MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processi...

CVE-2026-61747: Authorization Bypass Through User-Controlled Key

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no...

CVE-2026-94218: Missing Authorization

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

PT-2026-96048

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the User-Managed Access UMA implementation. The issue occurs at the authorization token endpoint when processing permission tickets. If two different users own resources wit...

CVE-2026-55625: Authorization Bypass Through User-Controlled Key

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...

CVE-2026-52740: Incorrect Authorization

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

CVE-2026-50572: Use After Free

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the...

ROS-20260921-73-0072

The vulnerability in the incus is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

PT-2026-96120

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.3.0 through 3.3.1 Description An issue exists in the Airflow core API where the system incorrectly prioritizes a session cookie over an explicit Authorization: Bearer token when both are present in a request. This...

PT-2026-96206

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An authorization check is missing on the 'POST /userBusiness/updateBtnStr' endpoint, allowing authenticated users to modify role button-permission definitions. An attacker can provide arbitrary roleId a...

CVE-2026-82355: Session Fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

PT-2026-96306

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description An authorization bypass exists in the 'getUserInfoById' endpoint. This flaw allows authenticated users to access the full profiles of other users by iterating the userId parameter. This can lead ...

PT-2026-96280

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.7 Description An authorization flaw exists in the ItemModel.checkIfAllowed function. The system allows write access to items with a share ID if any entry exists for the caller in the share users table, even ...

CVE-2026-55060: Incorrect Authorization

GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/processlist endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line...

Linux Distros Unpatched Vulnerability : CVE-2026-93854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and...

Linux Distros Unpatched Vulnerability : CVE-2026-93852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an...

CVE-2026-94213: Missing Authorization

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...

Security update for cadvisor (important)

openSUSE Security Update: Security update for cadvisor Announcement ID: openSUSE-SU-2026:0340-1 Rating: important References: 1279044 1279224 1279320 Cross-References: CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 CVSS scores: CVE-2026-84303 SUSE: 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N...

CVE-2026-94393: Authorization Bypass Through User-Controlled Key

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94217: Missing Authorization

A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...