CVE-2026-63349

A flaw was found in AnyIO. When launching child processes using anyio.openprocess, the extragroups argument is incorrectly handled. This can allow a less-privileged child process to retain the supplementary groups of its parent, potentially leading to unintended privilege retention. This issue...

CVE-2026-81921

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

GHSA-V859-C572-QH5P ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects shared between different organizations, potentially allowing users to ke...

PT-2026-91738

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.15.3 ZITADEL versions 3.0.0 through 3.4.12 Description A bug exists in how the platform updates permissions when multiple project roles are deleted simultaneously. This issue specifically affects User Grants on...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

EUVD-2026-75173

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes...

EUVD-2026-75541

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

PT-2026-89454

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

PT-2026-89371

Name of the Vulnerable Software and Affected Versions Capgo affected versions not specified Description Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, which leaves stale overrides active. This allows attackers to retain channel-specif...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2021-48006

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

UBUNTU-CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

CVE-2026-56842

A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Application to persist privileges within UniFi Network Application after such access had been removed...

CVE-2026-46424 Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour

Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint POST /api/public/v1/roles/unassign updates user documents in CouchDB but does not invalidate the corresponding Redis user cache entries. Because the authentication middleware resolves user...

Incorrect Privilege Assignment

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the POST /api/public/v1/roles/unassign endpoint. Users can retain their privileges up to one hour after bulk...

CVE-2026-41133 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database...

CVE-2025-63384

A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET Supervisor-mode Exception Return instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode M-mode to Supervisor-mode S-mode as specified by...

CVE-2025-63384

A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET Supervisor-mode Exception Return instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode M-mode to Supervisor-mode S-mode as specified by...

Rocket Chip Generator 安全漏洞

Rocket Chip Generator is an open source Sysem-on-Chip design generator from CHIPS Alliance Open Source. A security vulnerability exists in Rocket Chip Generator v1.6 and earlier versions, which stems from a failure of the SRET instruction to properly convert processor privilege levels, which coul...

CVE-2025-63384

The RISC-V Rocket-Chip (version 1.6 and earlier) contains a privilege retention vulnerability due to a flaw in the SRET (Supervisor-mode Exception Return) instruction handling. The processor fails to correctly transition from Machine-mode (M-mode) to Supervisor-mode (S-mode) as required by the ss...