CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-16544

AWX security issue: the websocket event consumer omits RBAC checks for inventory_update_events, project_update_events, and system_job_events, allowing any authenticated user to subscribe to these unmapped groups and view real-time stdout from jobs in other organizations. Affected component is the...

PT-2026-63463

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low privileges can perform unauthorized reads and writes on data protected by role-based query-level access controls. This occurs due ...

CVE-2026-61275

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Role Based Security. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

Gitea: Public-only repository tokens can update private PR head branches

Summary Gitea allows a public-only,write:repository token to update a private pull request head branch through a public base repository route. The vulnerable endpoint is: text POST /api/v1/repos/public-owner/public-repo/pulls/index/update Gitea checks the token's public-only restriction against t...

CVE-2026-11876 Missing Authorization in get_deployed_stack Endpoint in zenml-io/zenml

In zenml-io/zenml version 0.94.2, the GET /api/v1/stack-deployment/stack endpoint getdeployedstack lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector...

CVE-2026-11876

CVE-2026-11876 in zenml-io/zenml

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

CVE-2026-55550 NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog

NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...

EUVD-2026-45978

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

GO-2026-5941 Kite has an authenticated cluster RBAC bypass in /api/v1/overview in github.com/zxh326/kite

Kite has an authenticated cluster RBAC bypass in /api/v1/overview in github.com/zxh326/kite...

GO-2026-5999 milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery in github.com/milvus-io/milvus

milvus: RBAC grantee-id uses truncated MD5 64-bit, enabling privilege-binding collisions and cross-role privilege forgery in github.com/milvus-io/milvus...

GHSA-M2V6-2JMH-4C68 Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant has SecurityPolicy + TCPRoute RBAC baseline - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted the trigger - No admission...

PT-2026-60503

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the...

PT-2026-60111

Name of the Vulnerable Software and Affected Versions Woodpecker CI versions v1.0.0 through v3.15.0 Description A privilege escalation issue exists in instances using the Kubernetes backend. The pipeline option backend options.kubernetes.serviceAccountName is passed directly to the pod spec witho...

CVE-2026-62147

CVE-2026-62147 affects the Tempo Operator, specifically its gateway component. When query RBAC is enabled, the gateway fails to consistently apply namespace-scoped redaction on certain query API response paths, allowing an authenticated user to read span attributes belonging to other tenants’ nam...

CVE-2026-62147

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces. Mitigation There is no mitigation or workarou...

PT-2026-57809

Name of the Vulnerable Software and Affected Versions Tempo Operator affected versions not specified Description The gateway component fails to consistently apply namespace-scoped redaction on certain query API response paths when query RBAC Role-Based Access Control is enabled. This allows an...

ALPINE-CVE-2026-42486

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...