CVE-2026-123834

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account...

CVE-2026-123834

In JetBrains Datalore versions prior to 2026.4 , an improper scope validation within database tasks allows an attacker to utilize a service account from a different workspace. This authorization bypass (CWE-639) can result in high impacts on confidentiality, integrity, and availability. No specif...

EUVD-2026-118337

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account...

CVE-2026-123834

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account...

CVE-2026-123834: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's…

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account...

PoC---CVE-2023-26482-RCE-LAB-Nextcloud

Next cloud Proof of Concept & Analysis Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...

PYSEC-2026-4359

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

PT-2026-98983

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

EUVD-2026-80221

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-79708

CVE-2026-79708 is an incorrect authorization flaw in GitLab EE affecting versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Due to insufficient scope validation , an authenticated user with developer permissions could execute a policy test pipeline on projects within their g...

PT-2026-93329

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.0 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description Insufficient scope validation allows an authenticated user with developer permissions to execute a policy test...

GitLab 19.0 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-79708)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticate...

CVE-2026-79708: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

GHSA-VRH8-C9CM-WH8V ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

EUVD-2026-77452

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-90934

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-90934

EspoCRM before 10.0.4 is affected by a field-level security bypass in the meeting and call attendees endpoints. The root cause is incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions, allowing authenticated users to recover restricted email ad...