CVE-2026-106056 Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-106056

Rundeck versions before 6.2.0 are vulnerable to an OS command injection vulnerability. The flaw exists because the CLIUtils.quoteWindowsCMDArg method wraps free-text options in ineffective single quotes, allowing authenticated users with job run permissions to inject cmd.exe metacharacters like &...

PT-2026-107697

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description An improper authorization issue exists in the REST API,...

Apache SeaTunnel 3.0.0 Remote Code Execution

Summary SeaTunnel is a very easy-to-use, ultra-high-performance, distributed data integration platform that supports real-time synchronization of massive data. It can synchronize tens of billions of data stably and efficiently every day, and has been used in production by nearly 100 companies...

PT-2026-107691

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description An improper access control issue exists in the REST API,...

CVE-2026-107151: Missing Authentication for Critical Function

Missing authentication has been found in remote-execution task updates in the smartproxydynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote...

PT-2026-107481

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-76275: Improper Authorization

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution...

CVE-2026-76269: Authorization Bypass Through User-Controlled Key

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, jo...

PT-2026-107493

Name of the Vulnerable Software and Affected Versions smart proxy dynflow affected versions not specified Description Missing authentication exists in remote-execution task updates within the smart proxy dynflow package. When remote execution is configured in pull or pull-mqtt mode, the progress...

CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-26718

Description Summary A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via ...

CVE-2026-39775

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme = 2.2 versions...

CVE-2026-39775 WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme = 2.2 versions...

EUVD-2026-93025

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme = 2.2 versions...

CVE-2026-39775 WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme = 2.2 versions...

CVE-2026-39775

The JobZilla - Job Board WordPress Theme (versions

FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach

The U.S. Federal Bureau of Investigation FBI has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees. That's according to a report from Reuters, citing two sources familiar with the matter. "To...

CVE-2026-39775: Incorrect Privilege Assignment

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme = 2.2 versions...

PT-2026-115070

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions prior to 2.4.20 Description In the copy banner function within scheduler/ipp.c, the system improperly handles the attributes-natural-language value provided by a user when processing a job-sheets banner. An attacker...