CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

CVE-2026-100287

The Devolutions Server (version 2026.3.5.0 and earlier) is vulnerable to a missing authorization flaw in the attachment history API . This vulnerability allows an authenticated low-privileged user to perform unauthorized actions, specifically the ability to permanently delete or restore vault att...

EUVD-2026-89018

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

CVE-2026-100286

The Devolutions Server (version 2026.3.5.0 and earlier) is affected by a missing authorization vulnerability in the data source settings API . This flaw allows an authenticated non-administrative user to disclose integration secrets by sending a crafted API request. Exploitation details are not p...

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

EUVD-2026-89016

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

EUVD-2026-88999

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-93332

An improper access control vulnerability exists in the partial connection API of Devolutions Server version 2026.3.5.0 and earlier . An authenticated low-privileged user can exploit this by sending a crafted API request to perform unauthorized actions, including reading, creating, modifying, and ...

Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact

Summary Multiple vulnerabilities were addressed in IBM Tivoli Netcool Impact version 7.1.0.39 Vulnerability Details CVEID:CVE-2026-42402 DESCRIPTION: Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy...

CVE-2026-101269

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-71897 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-71897 Source advisory: MEND:CVE-2026-71897...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-71898 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-71898 Source advisory: MEND:CVE-2026-71898...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-71899 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-71899 Source advisory: MEND:CVE-2026-71899...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.2) +2 more potentially affected by CVE-2026-81569 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-81569 Source advisory: MEND:CVE-2026-81569...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.2) +2 more potentially affected by CVE-2026-82804 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-82804 Source advisory: MEND:CVE-2026-82804...

CVE-2026-101269 Incorrect session validation for API-uploaded files

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...