CVE-2026-92223 Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260910 - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents...

CVE-2026-90917

The Joomla! Core component is vulnerable to an improper access check in the outputs for tagged items. This flaw allows unauthorized users to view content items that are located within inaccessible categories across Joomla versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . No specific exploit details or remed...

EUVD-2026-89076

Joomla! Core - 20260907 - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories...

CVE-2026-90913

The Joomla! Core component is affected by an improper access check affecting webservice endpoints in versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . This vulnerability allows unauthorized users to perform mutation actions on specific access level endpoints. No specific exploit details or remediation versi...

CVE-2026-90913 Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260903 - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints...

CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-81569

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

CVE-2026-102371

The wsl-pro-service component (versions before 0.1.19ubuntu3 ) is vulnerable to information disclosure because it passes an Ubuntu Pro token as a command-line argument during the execution of the pro attach command. Since WSL defaults to mounting /proc without process-hiding mitigations like hide...

CVE-2026-93759

A flaw was found in Mongoid where it fails to properly neutralize string-typed query criteria. This vulnerability allows an unauthenticated attacker to inject server-side JavaScript expressions into database queries. Successful exploitation can lead to the unintended disclosure of sensitive store...

httpd: mod_auth_digest: timing attack allows a bypass of digest authentication

A flaw was found in the modauthdigest module of httpd. A remote unauthenticated attacker can bypass digest authentication by measuring timing discrepancies of requests. This issue leads to unauthorized access to resources protected by digest authentication...

CVE-2026-71897

Apache DolphinScheduler versions prior to 3.4.3 are vulnerable to an improper authorization check within the batch-copy and batch-move endpoints. An authenticated user can exploit this flaw to operate on workflows in projects for which they lack the necessary permissions, potentially allowing the...

EUVD-2026-88816

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-81569

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an improper authorization flaw in the handling of sub-workflow tasks. The system fails to verify if an authenticated user has the necessary permissions to access a target project or execute a referenced workflow within a sub-workflow...

EUVD-2026-88814

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

CVE-2026-81569 Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

httpd: mod_auth_digest: timing attack allows a bypass of digest authentication

A flaw was found in the modauthdigest module of httpd. A remote unauthenticated attacker can bypass digest authentication by measuring timing discrepancies of requests. This issue leads to unauthorized access to resources protected by digest authentication...

CVE-2026-73596

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Informatio...

RLSA-2026:72279 Critical: ipa security, bug fix, and enhancement update

Rocky Enterprise Software Foundation Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request...

CVE-2026-73596

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Informatio...

CVE-2026-73596

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Informatio...