1680 matches found
CVE-2026-18860 Velociraptor incorrect Org deletion permissions check
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...
CVE-2026-18860 Velociraptor incorrect Org deletion permissions check
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...
CVE-2026-18860 Velociraptor incorrect Org deletion permissions check
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...
EUVD-2026-56183
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...
CVE-2026-18860
CVE-2026-18860 affects Velociraptor in multi-tenant deployments using Orgs. Root-level ORG_ADMIN checks are bypassed when a caller from a child Org with that permission can delete other Orgs because the system validates ORG_ADMIN in the calling Org instead of the ROOT Org. This allows an administ...
CVE-2026-18635 Velociraptor query plugin allows impersonation in other orgs
Velociraptor's VQL has a query plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission usually only given to administrators. Velociraptor versions prior to 0.77.2 evaluate this...
CVE-2026-18635 Velociraptor query plugin allows impersonation in other orgs
Velociraptor's VQL has a query plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission usually only given to administrators. Velociraptor versions prior to 0.77.2 evaluate this...
CVE-2026-18635
CVE-2026-18635 concerns Velociraptor VQL’s query() plugin, where a caller with IMPERSONATE permission can run a query in a different org/user context. Prior to 0.77.2, the permission check evaluated the caller’s org instead of the target org, enabling an administrator in one org to impersonate a ...
CVE-2026-18635 Velociraptor query plugin allows impersonation in other orgs
Velociraptor's VQL has a query plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission usually only given to administrators. Velociraptor versions prior to 0.77.2 evaluate this...
PT-2026-70218
Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Velociraptor supports multi-tenant deployments called Orgs, consisting of a ROOT org and optional child orgs. The server incorrectly validates the ORG ADMIN permission when deleting Orgs...
CVE-2026-18635: Incorrect Authorization
Velociraptor's VQL has a query plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission usually only given to administrators. Velociraptor versions prior to 0.77.2 evaluate this...
gitea -- Multiple vulnerabilities
Gitea reports This release addresses the following security vulnerabilities. Please upgrade as soon as possible. Unauthenticated arbitrary file read via the Org-mode INCLUDE directive. Remote code execution via the diffpatch API through Git hook installation...
CVE-2026-18860: Improper Handling of Insufficient Permissions or Privileges
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...
CLSA-2026-1785954263 TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.9...
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
An unauthenticated attacker can read any file the service account can access on Gitea , the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1. The file-re...
CLSA-2026-1785921094 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.7...
CLSA-2026-1784769534 TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 3 CVEs. Fixed in 5.3.25-tuxcare.5...
CLSA-2026-1784769525 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 21 org.springframework packages to address 1 CVE. Fixed in 4.2.9.RELEASE-tuxcare.7...