EUVD-2026-94806

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...

CVE-2026-66084

An authorization bypass vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to modify task definitions in projects they are not authorized to access. The flaw exists in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpo...

CVE-2026-66082 Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...

EUVD-2026-94805

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...

CVE-2026-66082

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an authorization bypass (CWE-863) that allows authenticated users to perform unauthorized operations on workflow schedules, definitions, and task instances in other projects. The root cause is that affected endpoints verify permissio...

CVE-2026-94576

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying...

Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927

ペネトレーションテスト練習用の脆弱なNext.jsアプリ これは、CVE-2025-29927（Next.jsミドルウェア認証バイパス脆弱性）に対して脆弱になるように意図的に設計されたNext.jsアプリケーションです。 ⚠️ 免責事項 このアプリケーションは教育および倫理的なハッキング目的のみで使用してください。 本番環境にデプロイしないでください。脆弱性は意図的に仕込まれており、セキュリティテストや練習のために使用されることを想定しています。 脆弱性の詳細 CVE ID: CVE-2025-29927 説明:...

CVE-2026-94576

A vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 . This authentication logic flaw allows an authenticated user to bypass authorization restrictions, enabling them to modify the access privileges of other accounts. E...

CVE-2026-94576

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying...

CVE-2026-94575

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-107445 Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-107445

A flaw in Katello exists where the Flatpak Remote Repositories API fails to properly enforce authorization when accessing repositories by identifier. This allows an authenticated user with permissions in one organization to potentially access repository information belonging to a different organi...

CVE-2026-107445 Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-107444 Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass

A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrieve repository metadata associated with...

CVE-2026-107444

A flaw in Katello allows for a cross-organization authorization bypass via the Docker Tags repositories API . Because the API fails to properly enforce organization scoping when listing repositories for a Docker meta tag, an authenticated user with permission to view products in one organization ...

CVE-2026-107444 Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass

A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrieve repository metadata associated with...

CVE-2026-87659

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...

CVE-2026-94575

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-94578

Brocade Fabric OS versions before 10.0.1 are affected by an authorization logic vulnerability within the AAA (Authentication, Authorization, and Accounting) integration framework. This flaw allows remote authenticated users to bypass administrative role restriction checks during session establish...

CVE-2026-87659

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1 . A compromised switch within the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative au...