CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

MINI-5C48-F38R-M9PX

Bulletin has no description...

MINI-JQ7P-FJWG-CWV3

Bulletin has no description...

BIT-AIRFLOW-2026-68076 Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

PT-2026-76700

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.17917 Description An issue exists that allows the unauthorized transfer of projects between organizations. Recommendations Update to version 2026.2.17917...

UBUNTU-CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

EUVD-2026-59420

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

CVE-2026-72183

CVE-2026-72183 concerns a Linux kernel LANDLOCK bypass on the SIGIO path. The vulnerability allowed a sandboxed process that owns a file/socket to arm fcntl(F_SETOWN), F_SETSIG and O_ASYNC so that an I/O event would deliver a chosen signal to the entire process group, potentially affecting non-sa...

CVE-2026-72183 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

EUVD-2026-58941

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

CVE-2026-19639 Improper Access Control

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

CVE-2026-19639

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

CVE-2026-72836

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

CVE-2026-72830

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission, while the scheduler and backups gates use a bare isSuperAdmin check that...

CVE-2026-72829

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72828

Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...

CVE-2026-72833

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...

CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72822

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...