Fleet: ORDER BY column injection on activity list endpoints

Summary An authenticated user with read access to Activity could influence the ORDER BY clause of the activity list endpoints by supplying an arbitrary sort column: - GET /api/v1/fleet/activities ListActivities - GET /api/v1/fleet/hosts/id/activities ListHostPastActivities This originated from th...

CVE-2026-55095

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

EUVD-2026-63463

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

EUVD-2026-62936

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

CVE-2026-76372

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-76371

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

CVE-2026-76372 Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-76371 Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

CVE-2026-76371

In FireAMP versions below 2.1.15, the connector action manifest misclassifies the "add listitem" action as read-only despite it modifying file lists. A user with playbook edit/run privileges could exploit this in a Safe Mode playbook to make unauthorized file-list changes. CVSS 2.7 (LOW). Fix: up...

EUVD-2026-62541

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey stores a declared scopes array, but ApiKeyAuthenticator::authenticate does not read keyDatascopes and returns the owning user's...

CVE-2026-62667

CVE-2026-62667 affects the Grav API Plugin (a RESTful API for Grav CMS) prior to version 1.0.6 . The root cause is an authorization bypass : ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() never reads or enforces it, returning the owning user's...

CVE-2026-76224 ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback

ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...

BIT-KIBANA-2026-49089 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

BIT-ELK-2026-49089 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

CVE-2026-72031

A flaw was found in the Linux kernel's libata-core component. When a PNY CS900 1TB SSD enters Device-Initiated Slumber during idle, it can drop off the bus and become unresponsive. This issue prevents the system from accessing the drive, forcing the filesystem into a read-only state, which result...

GHSA-6C8M-Q6G9-VRW3 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Summary Lemur's destination read endpoints -- GET /api/1/destinations and GET /api/1/destinations/ -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints POST/PUT/DELETE a...

CVE-2026-71307 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...

EUVD-2026-61153

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...

CVE-2026-48508

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...

CVE-2026-48508 Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...