CVE-2026-51903

SuperAGI v0.0.14 is vulnerable to an improper access control vulnerability within the get_agent_by_latest_execution function located in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can exploit this by supplying a victim project_id to the /agentexe...

CVE-2026-117626

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

CVE-2026-117626

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

CVE-2026-117626

Jenkins versions 2.587 and earlier (including LTS 2.580.1 and earlier ) are vulnerable to a path traversal flaw in the file browser for workspaces and $JENKINS_HOME/userContent/. Due to improper file path identification, an attacker with Overall/Read permission can obtain file names, sizes, and l...

EUVD-2026-112191

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

CVE-2026-50542 Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/id allow an authenticated user with any privileges to view the status and metadata of any layout, including...

CVE-2026-50542 Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/id allow an authenticated user with any privileges to view the status and metadata of any layout, including...

CVE-2026-50542 Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/id allow an authenticated user with any privileges to view the status and metadata of any layout, including...

CVE-2026-50542

The Xibo digital signage platform is vulnerable to an Insecure Direct Object Reference (IDOR) due to missing access-control checks on the GET /layout/status/{id} endpoint. An authenticated user with any privileges can exploit this to view the status and metadata of any layout, including those for...

PT-2026-128314

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

CVE-2026-117626: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

Linux Distros Unpatched Vulnerability : CVE-2026-116187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other...

CVE-2026-116187

A flaw was found in Rclone's S3 authentication proxy. This authorization bypass allows an authenticated tenant who obtains another user's upload identifiers to interact with in-progress multipart uploads across tenant boundaries. A remote authenticated attacker can exploit this flaw to inject...

UBUNTU-CVE-2026-116187

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject part...

CVE-2026-116187

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject part...

EUVD-2026-109445

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject part...

CVE-2026-116187

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject part...

CVE-2026-116187 Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject part...

CVE-2026-115416

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not...

WordPress MB Custom Post Types & Custom Taxonomies plugin 2.4.0-2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure vulnerability

Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure vulnerability discovered by RIA Labs in WordPress Plugin MB Custom Post Types & Custom Taxonomies versions 2.4.0-2.12.2...