PYSEC-2026-4111 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...

CVE-2026-83805

Nautobot versions 3.0.0 through 3.1.8 are vulnerable to an authorization bypass in the approval workflow REST API. The generic ApprovalWorkflowStageResponse create endpoint fails to enforce approver-group membership, object change permissions, or the one-response-per-user restriction. An attacker...

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...

EUVD-2026-46123

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852 Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852 Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

PT-2026-61740

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin affected versions not specified Description An authentication bypass exists in the scheduler-webhook plugin due to a short-circuit logic flaw during webhook token validation. This allows unauthenticated remote...

CVE-2026-45187

Apache OFBiz is affected by an Improper Authorization vulnerability in the Webtools component. This flaw specifically occurs during Scheduled Job Creation , where it allows low-privileged users to submit system jobs . This issue impacts all versions prior to 24.09.06 . To remediate this vulnerabi...

CVE-2026-45187 Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs

Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...

CVE-2021-41112

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could...

EUVD-2021-28247

Malicious code in bioql PyPI...

CVE-2025-38436 drm/scheduler: signal scheduled fence when kill job

In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: signal scheduled fence when kill job When an entity from application B is killed, drmschedentitykill removes all jobs belonging to that entity through drmschedentitykilljobswork. If application A's job depends on a...

SingleStore: IDOR - Scheduled data leak to other accounts By "projectID"

The Insecure Direct Object Reference IDOR vulnerability was discovered in the GetNotebookScheduledPaginatedJobs endpoint on backend.singlestore.com. The API failed to verify the requestor's permission to access the specified project, allowing an authenticated user to access scheduled job...

CVE-2025-0218

CVE-2025-0218 affects pgAgent: when batch jobs run, a script is created in a temporary directory. In pgAgent versions before 4.2.3, the directory name is generated using an insufficiently seeded RNG, allowing a local attacker to pre-create the directory and disrupt job execution (DoS). Affected: ...

CVE-2023-40573: Improper Access Control

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a documen...

Vocera Report Server path traversal vulnerability

Vocera Report Server is a reporting application from Vocera USA. It is used to collect data from data logs created by Vocera system software and to build reports. A security vulnerability exists in Vocera Report Server and Voice Server versions 5.x - 5.8 that stems from the fact that the Vocera...

M-Files Resource Management Error Vulnerabilities

M-Files is an innovative metadata-driven document management platform from M-Files, Inc. A resource management error vulnerability exists in versions prior to M-Files 23.4.12528.1 that stems from uncontrolled memory consumption of scheduled jobs, which can be exploited by an attacker to cause a...