PT-2026-85216

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

PT-2026-85217

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

Dell iDRAC9 7.0.x < 7.00.00.182 / 7.20.x < 7.20.30.50 Improper Access Control (DSA-2026-374)

The version of Dell Integrated Remote Access Controller 9 iDRAC9 running on the remote host is 7.0.x prior to 7.00.00.182, or 7.20.x prior to 7.20.30.50. It is, therefore, affected by an improper access control vulnerability. A remote attacker with low privileges could potentially exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-74994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collaps...

PT-2026-85375

Name of the Vulnerable Software and Affected Versions Ignition versions prior to 8.1.54 Description An authenticated user can create projects due to a blank default configuration in the Gateway 'Create Project Roles' setting. This flaw allows attackers to escalate privileges to project creators a...

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

CVE-2026-63385

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

CVE-2026-53635

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-45730

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CVE-2026-20279

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-77124

In Nexus Repository 3 , the script execution endpoint (POST /service/rest/v1/script/{name}/run) failed to check whether script execution had been administratively disabled via nexus.scripts.allowCreation=false. As a result, an account holding script-execution permission could still execute previo...

CVE-2026-53635

Open edX Platform is affected by an insufficient permission check in the set_course_mode_price() view at lms/djangoapps/instructor/views/instructor_dashboard.py:430. The endpoint is protected only by @login_required and performs no course-level authorization, meaning any authenticated user —inclu...

CVE-2026-53635 Open edX Platform: Insufficient Permission on set_course_mode_price()

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

DRUPAL-CONTRIB-2026-133

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+...

DRUPAL-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

DRUPAL-CONTRIB-2026-122

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form...

CVE-2026-84672

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-45730

Nuclio is a serverless framework for real-time events and data processing. The vulnerability exists in the Nuclio Dashboard's project management API on write paths (PUT /api/projects/{id}, DELETE /api/projects). The root cause is that these endpoints construct PermissionOptions without setting Me...

CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...