CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

EUVD-2026-58041

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

SUSE CVE-2026-44944

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e...

CVE-2026-70463: Incorrect Authorization

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

PT-2026-71663

Name of the Vulnerable Software and Affected Versions rsync versions 3.1.0 through 3.4.x Description An authorization bypass exists in the parsing of the auth users directive. The parser utilizes comma-only tokenization when splitting the user list, which fails to correctly process entries...

CVE-2026-73304: Exposure of Sensitive Information to an Unauthorized Actor

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...

CVE-2026-68369 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68369 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-13094 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file...

CVE-2026-72786

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

EUVD-2026-57446

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

Winter: Authenticated backend users can bypass Users controller permission checks

Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests XWINTERREQUESTHANDLER header. The AJAX path validates that handler names match the onA-Z\w+ pattern, but the postback path...

GHSA-J5JQ-CR68-V2XX Winter: Authenticated backend users can bypass Users controller permission checks

Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests XWINTERREQUESTHANDLER header. The AJAX path validates that handler names match the onA-Z\w+ pattern, but the postback path...

CVE-2026-72786: Improper Authorization

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

CVE-2026-66016: Cleartext Storage of Sensitive Information

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-13612: Authorization Bypass Through User-Controlled Key

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

PT-2026-71005

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...