CVE-2026-67100 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

CVE-2026-67100

HCL BigFix Service Management is affected by two vulnerabilities: a SQL Injection flaw and a Cross-Tenant Data Exposure flaw. An attacker can inject database commands to extract sensitive system details and manipulate request values to gain unauthorized access to full personal profile data and PI...

CVE-2026-67100 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

EUVD-2026-82767

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

CVE-2026-61795: Incorrect Comparison

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostnameregex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitte...

PT-2026-95501

Name of the Vulnerable Software and Affected Versions Convoy versions prior to 26.6.8 Description An issue exists in the GET /api/v1/projects/projectID/sources/sourceID endpoint where the system authorizes access to the project specified in the URL but fails to verify if the requested source...

PT-2026-95318

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description A security misconfiguration involving improper access controls allows an authenticated attacker to view restricted data elements across tenant boundaries. This issue...

CVE-2026-63458: Authorization Bypass Through User-Controlled Key

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

PT-2026-95495

Name of the Vulnerable Software and Affected Versions WACRM versions prior to 0.7.1 Description The software contains two security issues. First, the profiles update row-level security policy allows authenticated users to modify their own account role and account id variables, which can enable a...

PT-2026-95489

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.6 Description A validation error in internal/webhook/tenant/validation/forbidden annotations regex.go allows a malformed ForbiddenAnnotations.Regex value to bypass validation during a Tenant update. This...

CVE-2026-61794: Improper Input Validation

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbiddenannotationsregex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating...

PT-2026-95474

Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.31.4 kcp versions prior to 0.32.2 Description The kcp front-proxy fails to remove inbound identity headers before forwarding requests to shards. An authenticated tenant can inject forged headers, which the shard trusts ...

CVE-2026-21848: Improper Access Control

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries...

CVE-2026-67100: Improper Neutralization of Special Elements used in an SQL Command

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

PT-2026-95304

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description An authenticated attacker can exploit a SQL Injection flaw and a Cross-Tenant Data Exposure flaw. These issues allow the injection of database commands to extract...

CVE-2026-54519

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

EUVD-2026-82580

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-54519 AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-54495 Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

EUVD-2026-82405

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...