UBUNTU-CVE-2026-53625

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

EUVD-2026-87286

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

CVE-2026-53625: Missing Authorization

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

CVE-2026-77169

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

CVE-2026-77169

A vulnerability in the team folders (formerly group folders) app, when used in combination with the workspace app , allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges f...

CVE-2026-77169

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

CVE-2026-77169

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

EUVD-2026-82618

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

PT-2026-95209

Name of the Vulnerable Software and Affected Versions Nextcloud Team Folders affected versions not specified Description An issue exists in the team folders app previously known as group folders when integrated with the workspace app. This flaw allows delegated administrators with API/REST-only...

CVE-2026-77169: Improper Access Control

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

org.sonatype.nexus.common.components:nexus-api-rest-common (>=3.89.0-09, <=3.94.2-01), org.sonatype.nexus.common.components:nexus-audit-plugin (>=3.89.0-09, <=3.94.2-01) +33 more potentially affected by CVE-2026-17603 via org.sonatype.nexus.common.components:nexus-datastore-mybatis (>=3.89.0-09, <=3.94.2-01)

org.sonatype.nexus.common.components:nexus-datastore-mybatis MAVEN version =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.94.2-01 -...

org.sonatype.nexus.selfhosted.assemblies:nexus-repository-core (>=3.89.0-09, <=3.94.2-01) potentially affected by CVE-2026-17597 via org.sonatype.nexus.selfhosted.components:nexus-api-rest-selfhosted (>=3.89.0-09, <=3.94.2-01)

org.sonatype.nexus.selfhosted.components:nexus-api-rest-selfhosted MAVEN version =3.89.0-09, =3.89.0-09, =3.94.2-01 Source cves: CVE-2026-17597 Source advisory: MEND:CVE-2026-17597...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.9.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +111 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.97.0-13 and more Sourc...

org.sonatype.nexus.api.extdirect:nexus-api-extdirect-selfhosted (>=3.81.0-08, <=3.87.2-01), org.sonatype.nexus.api.rest:nexus-api-rest-common (>=3.81.0-08, <=3.87.2-01) +8 more potentially affected by CVE-2026-0600 via org.sonatype.nexus.plugins:nexus-blobstore-s3 (>=3.12.0-01, <=3.87.2-01)

org.sonatype.nexus.plugins:nexus-blobstore-s3 MAVEN version =3.12.0-01, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.60.0-02, =3.12.0-01, =3.12.0-01, =3.71.0-06, =3.37.0-01, =3.78.0-14, =3.83.0-08, =3.87.2-01 Source cves: CVE-2026-0600 Source advisory: SNYK:JAVA-ORGSONATYPENEXUSPLUGINS-14946105...

CVE-2024-44088

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2024-44088 Apache Geode: Reflected XSS

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2024-44088: Improper Neutralization of Input During Web Page Generation

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

EUVD-2022-1196

Malicious code in bioql PyPI...

EUVD-2022-41805

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-39323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features,...