74 matches found
CVE-2026-110804
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a...
EUVD-2026-102876
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a...
CVE-2026-110804
The Devolutions Server version 2026.3.8.0 and earlier is vulnerable to an improper modification of JIT elevation settings within the PAM checkout component. This flaw allows an authenticated user with PAM checkout access to either delete arbitrary Active Directory groups or retain elevated privil...
CVE-2026-110804
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a...
CVE-2026-110804: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a...
CVE-2026-57493
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...
CVE-2026-57493 FileRise: Remember-me auto-login uses stale admin role from token instead of current role
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...
EUVD-2026-101666
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...
CVE-2026-57493 FileRise: Remember-me auto-login uses stale admin role from token instead of current role
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...
CVE-2026-57493 FileRise: Remember-me auto-login uses stale admin role from token instead of current role
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...
CVE-2026-57493: Insufficient Session Expiration
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...
CVE-2026-88827
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges...
EUVD-2026-96775
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges...
PT-2026-141132
Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev102 Description pyLoad fails to invalidate active Flask sessions when an administrator modifies a user's password or permissions. This occurs because the system uses role and permission values copied into th...
CVE-2026-63349
A flaw was found in AnyIO. When launching child processes using anyio.openprocess, the extragroups argument is incorrectly handled. This can allow a less-privileged child process to retain the supplementary groups of its parent, potentially leading to unintended privilege retention. This issue...
CVE-2026-81921
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...
GHSA-V859-C572-QH5P ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions
Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects shared between different organizations, potentially allowing users to ke...
PT-2026-91738
Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.15.3 ZITADEL versions 3.0.0 through 3.4.12 Description A bug exists in how the platform updates permissions when multiple project roles are deleted simultaneously. This issue specifically affects User Grants on...
CVE-2026-77753
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...