ROS-20260902-73-0006

The vulnerability in mongodb-org is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

ROS-20260902-73-0007

The vulnerability in mongodb-org is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

ROS-20260902-73-0002

The vulnerability in mongodb-org is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

TencentOS Server 4: grafana (TSSA-2026:0869)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0869 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

EUVD-2026-68405

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables,...

CVE-2026-19197

CVE-2026-19197 is a broken access control vulnerability in Grafana 's dashboard snapshots feature. An organization administrator on a shared Grafana instance can delete snapshots belonging to other organizations and recover a snapshot's secret delete key using only its public share key , enabling...

Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot’s secret delete key using only its public share key broken access control...

CVE-2026-57897

A flaw was found in Gitea. This vulnerability allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job Application Programming Interfaces APIs. An attacker could exploit this to gain unauthorized access to sensitive information across different repositories...

CVE-2026-78148

A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpcserver::graphcompute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pu...

UBUNTU-CVE-2026-78148

A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpcserver::graphcompute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pu...

UBUNTU-CVE-2026-78147

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/opparams results in deserialization. The attack may be...

CVE-2026-78147

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/opparams results in deserialization. The attack may be...

BIT-GRAFANA-2026-11817 CVE-2026-11817 CVE Record

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

Grafana Labs 11.2.0 <= 11.6.16 / 12.2.0 <= 12.2.10 / 12.3.0 <= 12.3.8 / 12.4.0 <= 12.4.5 / 13.0.0 <= 13.0.3 / 13.1.0 < 13.1.1 Information Disclosure (CVE-2026-11817)

The version of Grafana Labs installed on the remote host is 11.2.x through 11.6.x prior or equal to 11.6.16, 12.2.x prior or equal to 12.2.10, 12.3.x prior or equal to 12.3.8, 12.4.x prior or equal to 12.4.5, 13.0.x prior or equal to 13.0.3, or 13.1.0. It is, therefore, affected by an information...

GNU Emacs: Arbitrary code execution

Background GNU Emacs is the extensible, customizable, self-documenting real-time display editor. Description A vulnerability has been discovered in GNU Emacs. Please review the CVE identifier referenced below for details. Impact An attacker could achieve arbitrary code execution by tricking a use...

ANT-2026-Y9HESEM8 · supabase/supabase · auth-bypass

auth-bypass medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-Y9HESEM8: AI data-sharing opt-in bypassed by mismatched org and project In...

EUVD-2026-60478

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

SUSE CVE-2026-18635

Velociraptor's VQL has a query plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission usually only given to administrators. Velociraptor versions prior to 0.77.2 evaluate this...

SUSE CVE-2026-18636

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to...

SUSE CVE-2026-18860

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...