PT-2026-92163

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.6 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user could bypass SAML SSO sign-in restrictions and authenticate...

PT-2026-92142

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions prior to 1.0.5 Description An authenticated user can bypass protection mechanisms in the IBM mcp-context-forge component. This occurs because the system performs an incomplete recursive inspection of neste...

PT-2026-92183

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description Improper authorization checks on internal data emission endpoints could allow an authenticated user to...

PT-2026-92393

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send to top and send to bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-44202: Server-Side Request Forgery (SSRF)

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes th...

CVE-2026-68489

A flaw was found in Plesk extensions Ruby and Node.js Toolkit. This static code injection vulnerability allows remote authenticated users to execute arbitrary code as root. The flaw is triggered by manipulating custom environment variables, leading to a complete compromise of the affected system...

CVE-2026-14277

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file...

CVE-2026-14276

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action...

CVE-2026-12759

CVE-2026-12759 affects IBM Cloud Pak for Business Automation (specifically IBM Business Automation Workflow ), where an authenticated user can trigger uncontrolled resource consumption leading to a denial of service (CWE-400). The vulnerability is rated CVSS 6.5 (Medium) with network attack vecto...

EUVD-2026-78150

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command...

CVE-2026-14275 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command...

CVE-2026-14277 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file...

CVE-2026-14277 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file...

CVE-2026-17628

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication...

CVE-2026-86830

Incorrect privilege assignment in Temporary Elevated Access Management TEAM for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended...

CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

Incorrect privilege assignment in Temporary Elevated Access Management TEAM for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended...

CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

Incorrect privilege assignment in Temporary Elevated Access Management TEAM for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended...

CVE-2026-55416

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reportsconfig permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by...

OESA-2026-3850 kata-containers-go security update

This is core component of Kata Container, to make it work, you need a isulad/docker engine. Security Fixes: A flaw was found in Kata Containers, affecting both its Rust and Go runtimes. An authenticated pod user can exploit this by setting the io.katacontainers.configpath annotation to an arbitra...

CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...