Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Summary Repo under test: https://github.com/Netflix/lemur The certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...

WordPress Essential Addons for Elementor plugin < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment vulnerability

Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment vulnerability discovered by Jakub Herman in WordPress Plugin Essential Addons for Elementor versions 6.7.2...

CVE-2026-75890

Duplicate of CVE-2026-50236. This CVE ID was reserved in error for a finding that already had an existing CVE assignment...

EUVD-2026-60936

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

ROS-20260818-73-0036

A vulnerability in Mariadb 11.8 is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260818-73-0034

A vulnerability in Mariadb 10.6 is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260818-73-0035

A vulnerability in Mariadb 11.4 is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260818-73-0033

The vulnerability in Mariadb is related to the incorrect assignment of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2026-53958: Improper Authentication

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id...

PT-2026-78240

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.9 Description An authenticated user can modify backend-managed identity attributes via the 'PATCH /api/users/:id' endpoint. This occurs because the whitelist in the update.js controller allows mass assignment of...

CVE-2026-67846

Berkeley Out-of-Order Machine BOOM commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE...

CVE-2026-67846: Incorrect Privilege Assignment

Berkeley Out-of-Order Machine BOOM commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE...

CVE-2026-45790

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...

EUVD-2026-60476

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...

Incorrect Permission Assignment for Critical Resource

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource in the NodeVM configuration when builtin: '' is used, which exposes the os and...

CVE-2026-16048

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

CVE-2026-16048 Channel member roles accept out-of-scope roles

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

CVE-2026-16048

Mattermost versions 11.8.x through 11.8.2, 11.7.x through 11.7.6, and 10.11.x through 10.11.21 fail to restrict the channel member roles API to channel-scoped roles, allowing a channel administrator to assign out-of-scope roles and gain additional permissions. Advisory MMSA-2026-00697 tracks the ...

CVE-2026-16048 Channel member roles accept out-of-scope roles

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...