EUVD-2026-56914

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an...

CVE-2026-73213

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addrlesseq in src/client/nsturnioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioaaddrinrange, allowing an authenticated TURN client to relay to an IPv6 peer that is numerically...

CVE-2026-73212 coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...

CVE-2026-73212 coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...

CVE-2026-73212

Coturn (TURN/STUN server) vulnerability CVE-2026-73212: The function good_peer_addr() in src/server/ns_turn_server.c fails to canonicalize IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms via ioa_addr_in_range() in src/client/ns_turn_ioaddr.c. This can let an authenticated RFC 6062 TCP...

CVE-2026-18640

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...

CVE-2026-18860

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...

CVE-2026-18640 Velociraptor directory traversal via the NewNotebook API

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...

CVE-2026-18860 Velociraptor incorrect Org deletion permissions check

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...

CVE-2026-18860 Velociraptor incorrect Org deletion permissions check

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...

CVE-2026-18860

CVE-2026-18860 affects Velociraptor in multi-tenant deployments using Orgs. Root-level ORG_ADMIN checks are bypassed when a caller from a child Org with that permission can delete other Orgs because the system validates ORG_ADMIN in the calling Org instead of the ROOT Org. This allows an administ...

EUVD-2026-56183

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...

CVE-2026-72539

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-72539

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-72539 Windmill Labs Windmill - Information Disclosure

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

EUVD-2026-56009

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-72539

Summary : CVE-2026-72539 affects Windmill Labs Windmill up to version 1.783.0, causing information disclosure. Affected component : drafts data store accessed via the Windmill drafts endpoint. Root cause : legacy ownerless drafts with null owner emails bypass ACL enforcement, allowing any authent...

CVE-2026-72539 Windmill Labs Windmill - Information Disclosure

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-41115

A flaw was found in Apache Kafka. An improper authorization vulnerability exists in the CONSUMERGROUPDESCRIBE API, where it incorrectly validates the DESCRIBE operation instead of the READ operation on the GROUP resource. This discrepancy can lead to misconfigured Access Control Lists ACLs,...

CVE-2026-18348

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...