CVE-2026-48051

Papra (document management platform) prior to version 26.5.0 is vulnerable to SSRF via its webhook delivery system. The issue arises because the SSRF protection checks only the registered webhook URL and ignores redirects; the HTTP client (ofetch) automatically follows 3xx redirects, and the redi...

CVE-2026-17568

CVE-2026-17568 describes improper access control in Devolutions Server’s role membership management endpoint. An authenticated non-administrative user with user-group membership management permission can escalate to administrator via a crafted API request. Affected: Devolutions Server 2026.2.4.0–...

CVE-2026-17568

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update

Red Hat Advanced Cluster Management for Kubernetes 2.15 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. Red Hat Advanced Cluster Management for Kubernetes 2.15 images Red Hat Advanced Cluster Management for Kubernetes provides...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.4 security update

The multicluster engine for Kubernetes 2.10 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.10 images The multicluster engine for Kubernetes provides the foundational components that a...

CVE-2026-66399

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...

CVE-2026-51300

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Important: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

A Subscription Management tool for finding and reporting Red Hat product usage Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their...

CVE-2026-66399

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...

CVE-2026-66399

CVE-2026-66399 concerns phpMyFAQ prior to 4.1.6. A privilege-escalation flaw exists in GroupController::updateMembers(): administrators with only group-management rights can add themselves to privileged groups without verifying required rights, enabling immediate inheritance of those permissions ...

CVE-2026-66399 phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...

CVE-2026-66399 phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...

EUVD-2026-49332

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...

CVE-2025-59178

Ericsson Packet Core Controller PCC versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system...

CVE-2025-59181

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users...

CVE-2025-59177

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages...

USN-8613-1: FreeIPMI vulnerabilities

Zhihan Zheng discovered that FreeIPMI had several buffer overflow vulnerabilities in ipmi-oem response message handling. A local attacker with control a malicious IPMI device or simulator could possibly cause FreeIPMI to crash, resulting in a denial of service. CVE-2026-33554, CVE-2026-50031...

CVE-2025-59181

CVE-2025-59181 concerns the Ericsson Packet Core Controller (PCC) up to version 1.38 (prior to 1.39) in the Configuration Management component. The issue is a directory traversal vulnerability that could allow an attacker to change directory permissions, potentially denying access to legitimate u...

CVE-2025-59181 Path traversal Vulnerability

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users...

EUVD-2025-210516

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users...