CVE-2026-69226

A security flaw in Portal for ArcGIS allows unauthenticated users to create new accounts via the sharing endpoint. The vulnerability occurs because the application fails to enforce restrictions even when self-service account registration is disabled (disableSignup=true ). An attacker can bypass t...

CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...

Windows DNS Denial of Service Vulnerability

Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network...

CVE-2026-89196

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL...

PT-2026-111710

Name of the Vulnerable Software and Affected Versions WorkFlow-Engine versions prior to 9.6.12 Description Authenticated users can complete or reassign workflow tasks belonging to other users due to missing authorization. Low-privileged attackers can exploit this by providing a known taskId to th...

CVE-2026-110118: Authorization Bypass Through User-Controlled Key

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the replicationTaskExecutor process. An attacker can alter the state, description, owner, retention, archival settings, and cluster list of local namespaces by sending crafted inbound namespace replicatio...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the replicationTaskExecutor process. An attacker can alter the state, description, owner, retention, archival settings, and cluster list of local namespaces by sending crafted inbound namespace replicatio...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the replicationTaskExecutor process. An attacker can alter the state, description, owner, retention, archival settings, and cluster list of local namespaces by sending crafted inbound namespace replicatio...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the replicationTaskExecutor process. An attacker can alter the state, description, owner, retention, archival settings, and cluster list of local namespaces by sending crafted inbound namespace replicatio...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the replicationTaskExecutor process. An attacker can alter the state, description, owner, retention, archival settings, and cluster list of local namespaces by sending crafted inbound namespace replicatio...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the replicationTaskExecutor process. An attacker can alter the state, description, owner, retention, archival settings, and cluster list of local namespaces by sending crafted inbound namespace replicatio...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the internal completion callback process. An attacker can alter schedule state across namespaces by attaching a forged callback to a workflow start request, enabling unauthorized...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the internal completion callback process. An attacker can alter schedule state across namespaces by attaching a forged callback to a workflow start request, enabling unauthorized...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the internal completion callback process. An attacker can alter schedule state across namespaces by attaching a forged callback to a workflow start request, enabling unauthorized...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the internal completion callback process. An attacker can alter schedule state across namespaces by attaching a forged callback to a workflow start request, enabling unauthorized...

CVE-2026-66874

Gitea writes a synthetic "skipped" commit status for a workflow that matched an event but was excluded by its own "branches:" or "paths:" filter, so that a required status check tied to that workflow does not block indefinitely. For a "pullrequest" event the workflow definition is read from the...

CVE-2026-66877

Workflow runs from first-time fork contributors are held for maintainer approval only by inserting the run's jobs in a blocked state. The component that transitions blocked jobs to waiting does not re-check whether the run still needs approval. A separate, legitimate run in the same repository th...

CVE-2026-63792

"CanReadWorkflowCrossRepo" decides whether an Actions run may read a reusable workflow file referenced from another repository. Its "collaborative owner" branch grants cross-repository read through the collaborative-owner trust relationship without checking whether the run is a fork pull request...

Yousheng Software WorkFlow-Engine Authorization Issues Vulnerability

WorkFlow-Engine 9.6.11 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of an authorization check. Attackers can provide a known taskId through the /vue/buttonOperation endpoint, allowing them to perform unauthorized completion or reassign...