115644 matches found
PT-2026-68747
Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.1 Description An issue exists where a fully provisioned instance accepts unauthenticated POST requests to the /setup/create-admin-account endpoint. The system creates additional GLOBAL ADMIN accounts without...
PT-2026-68762
Name of the Vulnerable Software and Affected Versions sysPass affected versions not specified Description The doBackupFiles function in FileBackupService.php constructs a tar shell command by concatenating the backup directory path this-path directly into the command line without using...
PT-2026-68833
Name of the Vulnerable Software and Affected Versions Microsoft 365 Admin Center affected versions not specified Description Improper verification of cryptographic signatures in the Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network. Recommendations At...
PT-2026-68748
Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description A privilege escalation exists where a user with TENANT ADMIN permissions can promote themselves or another collaborator to a platform-wide GLOBAL ADMIN via a single PUT request. The role-update...
PT-2026-68578
Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description An issue allows unauthenticated users to perform privilege escalation within the software. Recommendations Update to a version newer than 3.29.10...
PT-2026-68577
Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description Broken access control exists within the subscriber role, allowing unauthorized access or actions within the administrative interface. Recommendations Update to a version newer...
PT-2026-68448
Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description Tokens issued to low-privileged users lack sufficient restrictions, enabling them to be used to access product-level Admin REST APIs. An attacker with a low-privileged account and a val...
CVE-2026-70443
Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...
CVE-2026-70430
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
Malicious code in @astralcore/sl-aura (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...
MAL-2026-13355 Malicious code in @astralcore/sl-aura (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...
CVE-2026-20288 Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...
EUVD-2026-53466
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...
CVE-2026-20288 Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...
Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.14 Images Security Update
New images are available for Red Hat build of Keycloak 26.4.14 and Red Hat build of Keycloak 26.4.14 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...
keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...
keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions FGAP v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not...
keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter
A flaw was found in the Fine-Grained Admin Permissions FGAP v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a...
keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...
keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...