CVE-2026-76310

An unauthenticated user with an embedded report token can download the search job dispatch archive via REST API, recover session material, and access all data available to the report owner—including admin-level actions—due to embedded report access not blocking dispatch archive downloads. Affecte...

CVE-2026-76263 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76263

Splunk Enterprise versions below 10.4.2 and 10.2.6 have a broken object-level authorization flaw in the data management orchestrator REST API, allowing low-privilege users to delete SPL2 modules owned by other users. CVSS 5.4 (MEDIUM). Patch to 10.4.2 or 10.2.6; see advisory SVD-2026-0801. No in-...

CVE-2026-76261

Non-admin/low-privilege users on Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Secure Gateway (below 3.10.9, 3.9.23, 3.8.70) can read Spacebridge asymmetric private keys via the App Key Value Store REST API. The root cause is incomplete private-key migration during upgrade, leaving...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-59992

Authenticated CMS editors can pass arbitrary object keys to PutObject/DeleteObject calls across four media adapters (S3, DOS, Azure, Cloudinary), bypassing mediaRoot boundaries. Fix: upgrade to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, or next-tinacms-cloudinary ...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-54741

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with...

CVE-2026-53548

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or...

CVE-2026-53546 Termix: Missing authorization in SSH host credential resolution exposes stored credentials

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...

EUVD-2026-62859

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...

CVE-2026-53546 Termix: Missing authorization in SSH host credential resolution exposes stored credentials

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...

CVE-2026-53546

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing. Prior to 2.3.2 , the terminal WebSocket accepts a user-controlled hostConfig.id, and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access . When no creden...

EUVD-2026-62857

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or...

CVE-2026-54741 Lemmy: Blocked users can edit private messages sent before the block

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with...

CVE-2026-54741

In Lemmy (versions before 0.19.19 and 1.0.0-alpha.18), the edit_private_message function in crates/api/api_crud/src/private_message/update.rs only verifies the caller is the original message creator, skipping the recipient block-list check that create_private_message performs. This allows a block...

CVE-2026-54742 Lemmy: `CollectionAdd::Featured` does not check the post is in the community

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction...

CVE-2026-75593 BuildKit: Malicious client can bypass destination directory validation on local sources upload

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

GHSA-VWG3-W8W3-PC79 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...