CVE-2026-76260 Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the restpropertiesget capability could read encrypted stored credentials through the Representational State Transfer REST API. Successful exploitation can expose relevant data protected by the...

CVE-2026-76260

CVE-2026-76260 is an incorrect permission assignment vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The properties REST endpoint checks for the rest_properties_get capability instead of the more restrictive list_storage_passwords capability, allow...

CVE-2026-68554 Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

CVE-2026-55483

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin...

CVE-2026-55483 Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin...

CVE-2026-55483

In Snipe-IT versions prior to 8.6.0, the store() method in UsersController.php strips the superuser permission but fails to strip the admin permission, allowing any authenticated user with the users.create permission to create accounts with full administrative privileges. The fix is included in v...

CVE-2026-55483 Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-64851

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss because it contains no literal less-than character, then...

EUVD-2026-62537

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

CVE-2026-62670 Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

CVE-2026-62670

CVE-2026-62670 is a fail-open authorization flaw in the Grav Flex Objects Plugin (by Trilby Media) prior to version 1.4.3 . The requireFlexPermission() method in classes/Api/FlexApiController.php (Admin Next API) returns without denying access when a directory blueprint omits config.admin.permiss...

CVE-2026-76223

ArcadeDB com.arcadedb versions 26.7.3 and earlier fail to enforce the UPDATESCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the...

CVE-2026-76216

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76223 ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION

ArcadeDB com.arcadedb versions 26.7.3 and earlier fail to enforce the UPDATESCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the...

EUVD-2026-62464

ArcadeDB com.arcadedb versions 26.7.3 and earlier fail to enforce the UPDATESCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the...

CVE-2026-76223 ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION

ArcadeDB com.arcadedb versions 26.7.3 and earlier fail to enforce the UPDATESCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-49430

The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...