266411 matches found
CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process
An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...
CVE-2026-84712 Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...
CVE-2026-85475 Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component
A flaw was found in the Ansible Automation Platform automation controller. The external logging rsyslog configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript conf...
EUVD-2026-85607
A flaw was found in the Ansible Automation Platform automation controller. The external logging rsyslog configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript conf...
CVE-2026-85475 Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component
A flaw was found in the Ansible Automation Platform automation controller. The external logging rsyslog configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript conf...
CVE-2026-85475
The Ansible Automation Platform automation controller is vulnerable to an injection flaw in its external logging (rsyslog ) configuration. The system generates configuration files by interpolating user-controlled settings—specifically LOG_AGGREGATOR_HOST , LOG_AGGREGATOR_MAX_DISK_USAGE_PATH , and...
CVE-2026-84719 Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...
CVE-2026-84719
A flaw exists in the Ansible Automation Platform automation-controller where the WorkflowJobTemplate deep-copy permission sanitizer fails to validate instance_groups , execution_environment , and labels during a copy operation. This oversight allows a user with organization workflow-admin permiss...
CVE-2026-84719 Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...
EUVD-2026-85606
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...
CVE-2026-95604
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CVE-2026-95602
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...
CVE-2026-95527
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
CVE-2026-94679
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
CVE-2026-95513
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...
CVE-2026-94498
Unauthenticated Broken Access Control in AppMySite = 3.15.4 versions...
CVE-2026-94079
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
CVE-2026-94080
Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...