CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2026-83805

Nautobot versions 3.0.0 through 3.1.8 are vulnerable to an authorization bypass in the approval workflow REST API. The generic ApprovalWorkflowStageResponse create endpoint fails to enforce approver-group membership, object change permissions, or the one-response-per-user restriction. An attacker...

CVE-2026-75791

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-75791 Authentication bypass vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-75791

ManageEngine ADSelfService Plus (by Zohocorp) versions before build 7001 are affected by an authentication bypass in its REST API . The vulnerability allows unauthenticated remote attackers to bypass authentication, with a CVSS 3.1 score of 8.6 (HIGH) — low attack complexity, no privileges or use...

EUVD-2026-84364

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-75791 Authentication bypass vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-92882

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

CVE-2026-92882 Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

CVE-2026-92882

Checkmk versions <2.5.0p15, <2.4.0p37,

EUVD-2026-84349

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

CVE-2026-92882 Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

BIT-NIFI-2026-81866 Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration step can apply Asset and Secret...

PT-2026-96700

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p15 Checkmk versions prior to 2.4.0p37 Checkmk versions prior to 2.3.0p51 Checkmk version 2.2.0 Description Insufficiently protected credentials in the host and folder configuration endpoints of the REST API allo...

PT-2026-96713

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to build 7001 Description An authentication bypass exists in the REST API, allowing an attacker to gain unauthorized access to the system. Recommendations Update ManageEngine ADSelfService Plus to...

PT-2026-96683

Name of the Vulnerable Software and Affected Versions Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels versions prior to 6.6.44 Description A Directory Traversal issue exists where authenticated attackers with shop manager-level access or higher can delete...

CVE-2026-75791: Missing Authentication for Critical Function

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

Zoho ManageEngine ADSelfService Plus: CVE-2026-75791: Authentication bypass vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-92882: Insufficiently Protected Credentials

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...