CVE-2026-55774

OpenBao is an open-source identity-based secrets management system. Prior to 2.5.5 , the lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the requesting namespace. This meant an authenticated user with access to sys/le...

CVE-2026-55774 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-55774 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-55774

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-52822 Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/id/restart, PATCH /api/timesheets/id/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked...

CVE-2026-55774: Incorrect Authorization

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

PT-2026-97281

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.58 Apache Tomcat versions 9.0.0-M1 through 9.0.121 Apache Tomcat versions 8.5.0 through 8.5.100 Description An improper check for certificate...

GHSA-V859-C572-QH5P ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects shared between different organizations, potentially allowing users to ke...

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects shared between different organizations, potentially allowing users to ke...

CVE-2026-76081 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

EUVD-2026-78163

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

CVE-2026-76081 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

CVE-2026-76081

ZITADEL , an open source identity management platform, contains a permission revocation flaw affecting versions prior to 4.16.0 . When multiple project roles are deleted simultaneously, a bug in the permission-update logic can cause some User Grants on Granted Projects (projects shared between or...

CVE-2026-76081 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey

A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority CA. A remote attacker could potentially exploit this by presenting a revoked key, leading t...

Astra Linux – Vulnerability in Thunderbird

The OCSP revocation status of certificates was not checked when verifying S/Mime signatures. Emails signed with revoked certificates would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird versions...

Astra Linux – Vulnerability in StrongSwan

Before version 5.9.8, StrongSwan allowed remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity and intermediate CA certificate that contained a CRL/OCSP URL pointing to a server under the attacker’s control that did not respond properly. In some...

Astra Linux – Vulnerability in Thunderbird

When importing a revoked key with “key compromise” as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked. As a result, the existing key remained unrevoked. Revocation statements that used another revocation reason, or those that did not specify...

Astra Linux – Vulnerability in Thunderbird

The OCSP revocation status of recipient certificates was not checked when sending S/MIME encrypted emails. As a result, revoked certificates were accepted. This bug affected Thunderbird versions from 68 to 102.9.1. This vulnerability affects Thunderbird versions earlier than 102.10...

Astra Linux – Vulnerability in curl

Curl versions 7.41.0 through 7.73.0 are vulnerable to a flaw related to improper checks for certificate revocation, due to insufficient verification of the OCSP response...