CVE-2026-12631 Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel

The Zephyr kernel validates the kthreadjoin and kthreadabort system calls declared syscall in include/zephyr/kernel.h through threadobjvalidate in kernel/thread.c. Its default switch branch is the access-denied path, taken when kobjectvalidate returns -EPERM the calling user thread was never...

GHSA-4H97-P9WQ-CHQJ Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

CVE-2026-59894 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2025.1-fips, netbox, openstack-keystone-2025.1, openstack-glance-2026.1-fips, openstack-placement-2025.1-fips, openstack-placement-2026.1, openstack-nova-2025.1, openstack-placement-2025.2-fips, airflow, openstack-glance-2025.2-fips,...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: kayenta-fips, floci, akhq, keycloak-fips, cruise-control-fips, elasticsearch-fips, zipkin, reposilite, s3proxy-fips, management-api-for-apache-cassandra-5.0, cruise-control, apache-activemq-artemis-fips, opensearch, nuxeo, seata, spark, hono, camunda-zeebe, keycloak,...

CVE-2026-18504 fastify vulnerable to schema validation bypass via root primitive coercion mismatch

fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string in...

EUVD-2026-61221

fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string in...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-71322

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...

CVE-2026-67442

FUXA (web-based SCADA/HMI/Dashboard) prior to 1.3.3 has a business-logic flaw in the DELETE /api/roles endpoint. When a role is deleted, the role identifier is not removed from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifi...

EUVD-2026-61214

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 is affected by a missing authorization flaw in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. Unlike the sibling handler for GET /a/share/cell/{Uuid}, which enforces MatchPolicies with ResourcePolicyAction_READ, the link handler calls L...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

EUVD-2026-61205

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-71322 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...

EUVD-2026-61157

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-71307

In Lemur before 1.9.3, GET /api/1/destinations endpoints required only basic authentication, allowing low-privilege users to read plaintext SFTP passwords and private-key passphrases stored by the sftp-destination plugin. CVSS 7.7 HIGH (network, low complexity). Fixed in 1.9.3 by requiring admin ...

EUVD-2026-61152

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces or replacements identifiers that AssociatedCertificateSchema resolved with fetchobjects without a CertificatePermission check. Assigning those objects to...