CVE-2026-81668

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

CVE-2026-81658

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-15742

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

EUVD-2026-65543

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

PT-2026-81353

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

CVE-2026-78387 RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

Johnson Controls Metasys 12.x / 13.x / 14.x < 14.1.5 / 15.x < 15.0.1 Cross-Site Scripting (CVE-2026-34491)

A low-privilege user can inject a malicious XSS payload into the Johnson Controls Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. Successful exploitation of this vulnerability could allow a low-privileg...

CVE-2026-55491 BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...

UBUNTU-CVE-2026-73196

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

PT-2026-79192

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description An issue exists where the software fails to escape the meetingName variable in the record-and-playback/screenshare/playback/index.html.erb file during the generation of the screenshare playbac...

PT-2026-78907

Name of the Vulnerable Software and Affected Versions Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 affected versions not specified Description An issue exists where improper enforcement of role-based access control allows a low privileged remote attacker with a valid session to create new...

CVE-2026-76394

Splunk AI Toolkit versions below 6.0.0 have multiple REST API handlers that fail to enforce authorization checks, allowing low-privileged users (without admin or power roles) to start/stop/configure containers and read/modify connection and configuration data. CVSS 8.3 HIGH; remediation is to upg...

CVE-2026-76360 Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

BIT-ELK-2026-72661 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint...

PT-2026-78736

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A low-privileged user without admin or power roles can...

Microsoft Windows Admin Center Remote Code Execution

Microsoft Windows Admin Center builds prior to 2.7.4 contain a command injection vulnerability in the PowerShell tool REST API. An authenticated low-privileged gateway user can supply arbitrary commands through the properties.script field of an invokeCommand request, resulting in command executio...

BIT-ACTIVEMQ-2026-61487 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...

PT-2026-73378

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

PT-2026-73236

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...