CVE-2026-41424 Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

CVE-2026-41424 Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

PYSEC-2026-3684 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...

ROS-20260819-73-0020

The vulnerability in MediaWiki relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-78502

Name of the Vulnerable Software and Affected Versions Cisco Crosswork affected versions not specified Description Multiple issues related to insufficiently protected credentials were identified during an internal security review. These issues fall under the category of CWE-522, which refers to th...

The vulnerability of the Microsoft .NET software platform and the Microsoft Visual Studio development tools relates to a flaw in the data protection mechanism, which allows an attacker to disclose protected information.

The vulnerability of the Microsoft .NET software platform and the Microsoft Visual Studio development tools is related to a breach of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of protective measures for website structures, allowing attackers to execute arbitrary code.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities allows a malicious actor to...

The vulnerability of the Apache HTTP Server web server lies in its lack of protection for website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Apache HTTP Server is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerabilities of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server allow attackers to perform spear-phishing attacks.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow attackers to perform spear-phishing...

The vulnerability in the `openssl_encrypt/modules/plugin_system/plugin_sandbox.py` file of the `openssl_encrypt` library, written in Python, allows a malicious individual to gain unauthorized access to read and write arbitrary files.

The vulnerability in the opensslencrypt/modules/pluginsystem/pluginsandbox.py file, belonging to the opensslencrypt library written in Python, relates to a data protection mechanism flaw. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to rea...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of protective measures for website structures, allowing attackers to execute arbitrary code.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities allows a malicious actor to...

CVE-2026-72325

A flaw was found in the Linux kernel's performance monitoring unit PMU for AMD processors. When Secure Virtual Machine SVM is toggled on a CPU with active Last Branch Record LBR events, the system incorrectly attempts to enable Branch Sampling BRS on hardware that does not support it. This...

CVE-2026-72279

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel. KVM on arm64 architectures incorrectly maps the L1 Virtual Nested Control Register VNCR into the host stage-1, failing to respect read-only memory regions. This could allow a malicious guest to write to a...

CVE-2026-67262

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

CVE-2026-67262

Dell PowerStore has a Missing Authorization flaw allowing an attacker with mapped-host access to read or write LUNs beyond per-initiator access controls, enabling confidentiality, integrity, and availability impacts (CVSS 8.1 HIGH). Dell DSA-2026-330 advisory is referenced, but no affected versio...

CVE-2026-67262

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

EUVD-2026-61073

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

CVE-2026-67262

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

SUSE CVE-2026-72069

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock; invalidatep;...

CVE-2026-72180

A flaw was found in the Linux kernel's huge memory management mm/hugememory. When a device-private Page Middle Directory PMD is downgraded, the pmdswpuffdwp bit, which indicates Userfault File Descriptor Write Protect UFFDWP, is not properly preserved. This oversight allows a local attacker to...