PT-2026-76959

Name of the Vulnerable Software and Affected Versions Zabbix version 7.4 Description The cryptographic key used for signing Frontend sessions is incorrectly written to the database seed. This issue affects deployments that simultaneously use SAML authentication and guest users, allowing the key t...

CVE-2026-67442: Improper Access Control

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-75046

JetBrains YouTrack before 2026.2.18112 has an authenticated user enumeration flaw in the users search endpoint, allowing account discovery (CVSS 4.3 MEDIUM). No exploitation details are provided; upgrade to 2026.2.18112 or later. Monitor JetBrains issue tracker for further advisories.

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

BIT-AIRFLOW-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

PT-2026-76695

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-11817: Incorrect Authorization

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-75046: Missing Authorization

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-44846: Incorrect Authorization

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-72325

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling BRS and Last Branch Record LBR are mutually exclusive hardware features, and users of both are tracked via cpuc-lbrusers. When SVM is toggled on a CPU...

CVE-2026-72325

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling BRS and Last Branch Record LBR are mutually exclusive hardware features, and users of both are tracked via cpuc-lbrusers. When SVM is toggled on a CPU...

CVE-2026-72325

Technical details of CVE-2026-72325 are not public in the provided documents. Available descriptions summarize the issue but do not expose affected products, versions, or fixes. Monitor for updates from vendors/security advisories.

CVE-2026-72325 perf/x86/amd/core: Avoid enabling BRS from the SVM reload path

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling BRS and Last Branch Record LBR are mutually exclusive hardware features, and users of both are tracked via cpuc-lbrusers. When SVM is toggled on a CPU...

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

A SELECT permission defined on an array element DEFINE FIELD field. … PERMISSIONS FOR select … is not enforced correctly for RECORD users. Instead of hiding the denied elements, the query leaks a subset of them: a deny-all returns the odd-indexed elements, and a per-element predicate keeps and...

Security Bulletin: Code Injection Vulnerability in Code Validation Endpoint

Summary A code injection vulnerability was identified in the code validation endpoint that allowed authenticated users to execute arbitrary code on the server. The vulnerability existed in the validation logic which compiled and executed function definitions to check for import errors. Attackers...

EUVD-2026-58542

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...

PT-2026-81120

A SELECT permission defined on an array element DEFINE FIELD field. … PERMISSIONS FOR select … is not enforced correctly for RECORD users. Instead of hiding the denied elements, the query leaks a subset of them: a deny-all returns the odd-indexed elements, and a per-element predicate keeps and...

KLA91223 PE vulnerability in Microsoft System Center

Privilege escalation vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-69414 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Malware-Protection-Engine CVE list...

CVE-2026-63649: Permissive List of Allowed Inputs

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...