CVE-2026-91085

A vulnerability exists in Apache Karaf where the shell/SSH command security system fails open when no specific Access Control List (ACL) rule matches a command. Specifically, the org.apache.karaf.command.acl.config ACL lacks an entry for config:install, allowing any authenticated user—including t...

CVE-2026-102373 GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

CVE-2026-54708

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or writ...

CVE-2026-54675 FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution RCE. Authentication...

Security Bulletin: IBM DataPower Gateway affected by server-side request forgery (CVE-2026-14521)

Summary IBM DataPower Gateway affected by server-side request forgery CVE-2026-14521 Vulnerability Details CVEID:CVE-2026-14521 DESCRIPTION: IBM DataPower Gateway is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the...

EUVD-2026-88201

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.useradd&userid=45&option=comvirtuemart'. Successful exploitation of this vulnerability could allow an...

CVE-2026-82377

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

EUVD-2026-87946

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation...

CLEANSTART-2026-PN24745 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the loki package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CVE-2026-57449

The Actual Sync Server (prior to version 26.7.0 ) is vulnerable to a CORS proxy allowlist bypass. When ACTUAL_GITHUB_TOKEN is configured, the server's CORS proxy uses a raw startsWith() prefix test to validate GitHub repositories against an official plugin allowlist. Because the check fails to re...

CVE-2026-100417

RustDesk versions before 1.5.0 on Windows are vulnerable to a bypass of the one-way file transfer option. The root cause is a failure to enforce this restriction against peer clipboard file requests, which allows authenticated peers to read files from the host clipboard. An attacker can retrieve ...

EUVD-2026-87280

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0...

CVE-2026-65828

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroyform action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied formid without verifying that the requesting user owns those records. An authenticated...

CVE-2026-84460 Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization...

CVE-2026-89032

BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...

CVE-2026-61525 Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...

CVE-2026-61525 Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...

CVE-2026-67407 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

CVE-2026-67407 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

CVE-2026-67407

RabbitMQ , a messaging and streaming broker, is affected by an incomplete fix for CVE-2026-44838. The escaperegexchar/1 function fails to escape the - character, which allows for an MQTT topic permission bypass . Specifically, when a topic permission template places {clientid} inside a [...] char...