EUVD-2026-67798

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267

Komodo (through version 2.3.2) contains a logic flaw in the /execute and /execute/{variant} API handlers, where internal resource identifiers are disclosed and audit log entries are written before permission checks are evaluated. Authenticated users can exploit this by guessing resource names to ...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2025-6000

CVE-2025-6000 — Esecuzione di Codice Privilegiata in HashiCorp Vault PoC Proof-of-concept per CVE-2025-6000 , una vulnerabilità di escalation dei privilegi fino a RCE nei backend di audit di HashiCorp Vault. Il dispositivo di audit consente a un chiamante privilegiato di controllare le opzioni...

CVE-2026-78614

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78614 Dimension SQL Injection in Audit Report

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78614

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature . An authenticated user with report administration permissions can send specially crafted requests to gain arbitrary command execution as the Dimension WebUI process user. The CNA-assigned CVSS ...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827

Flowintel versions >=3.3.0 contained a validation flaw in the login flow: the code called Email(email) (which only constructs a WTForms validator object) instead of Email()(form, form.email), so malformed attacker-supplied email values bypassed validation. Because CR/LF characters in the email...

EUVD-2026-66996

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-81658

Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...

CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093269)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093269 advisory. Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Log. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098891)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098891 advisory. In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qle...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093315)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093315 advisory. Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Plug-in. Supported versions that are affected are 5.7.25 and prior and 8.0.15...

Tenable Security Center SCAP Audit File Command Injection

This is a Metasploit module that demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated user to achieve command execution as the web service account tns via the SCAP audit file upload flow. This module requires Metasploit: https://metasploit.com/download Current...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093283)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093283 advisory. Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Plug-in. Supported versions that are affected are 5.7.26 and prior and 8.0.16...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...

JetBrains TeamCity < 2022.10 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2022.10. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings CVE-2022-44623 - In JetBrains...