SUSE CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

CVE-2026-58417

REST API exposes organization membership of private organizations to public...

CVE-2026-58417 REST API exposes organization membership of private organizations to public

REST API exposes organization membership of private organizations to public...

CVE-2026-58417 REST API exposes organization membership of private organizations to public

REST API exposes organization membership of private organizations to public...

CVE-2026-58417

The CVE-2026-58417 issue affects Gitea: the REST API endpoint /orgs/{org}/public_members/{username} leaks organization membership of private orgs to public. According to the sources, an authenticated user can probe membership of a user in a private org and receive a response (PoC shows HTTP 204) ...

ALPINE-CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

EUVD-2026-57834

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

CVE-2025-9486

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

CVE-2025-9486 Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

EUVD-2025-210720

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

CVE-2025-9486 Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

CVE-2025-9486

CVE-2025-9486 affects GitLab EE, with versions 15.6 up to before 19.0.6, 19.1 up to before 19.1.4, and 19.2 up to before 19.2.2. The issue arises from an incorrect privilege assignment that did not account for a user’s pending membership state, potentially allowing a user to receive permissions g...

CVE-2026-42142

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...

EUVD-2026-56235

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...

CVE-2026-72534

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adop...

EUVD-2026-56004

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adop...

CVE-2026-72534 Authentik Security authentik - Privilege Escalation

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adop...

CVE-2026-72534 Authentik Security authentik - Privilege Escalation

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adop...

SUSE CVE-2026-58417

REST API exposes organization membership of private organizations to public...

Apache Tomcat 9.0.13 < 9.0.117 Insertion of Sensitive Information Vulnerability

The version of Tomcat installed on the remote host is 9.0.13 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering...