EUVD-2026-102073

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC Authorization Policy Bypass via Missing :path Slash Auth Bypass Description The authz package in google.golang.org/grpc implements SDK-level RBAC authorization using deny and allow rules matched against the :path pseudo-header. The HTTP/2 server transport stores the ra...

CVE-2026-102596

Prior to version 0.70.9 , the Nango platform contained an RBAC bypass affecting accounts with has_rbac=true. The vulnerability exists because two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, failed to include the necessary can authori...

CVE-2026-102596 Nango: Production flow RBAC bypass on private flow-read routes

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with hasrbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth b...

CVE-2026-102596 Nango: Production flow RBAC bypass on private flow-read routes

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with hasrbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth b...

CVE-2026-107334

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS . Affected versions include those prior to 9.2.2d and versions 10.0.0 through 10.0.0a1 . The root cause allows an authenticated user or local process capa...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

EUVD-2026-94742

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

CVE-2026-94575

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-94575

A logic vulnerability exists in the Brocade Fabric OS web management framework in versions before 10.0.1 . This flaw allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation can lower the ...

CVE-2026-94575

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

EUVD-2026-94682

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-94575

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-94577: External Control of System or Configuration Setting

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

PT-2026-107799

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 10.0.1 Description A logic issue in the web management framework allows an authenticated user with low privileges to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions...

CVE-2026-94575: Incorrect Block Delimitation

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-107333: Incorrect Authorization

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control RBAC authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions...