PT-2026-107168

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

RockyLinux 8 : sudo (RLSA-2026:75580)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75580 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

Cisco ASA Missing Authorization (CVE-2024-20355)

A vulnerability in the implementation of SAML 2.0 single sign-on SSO for remote access VPN services in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to successfully establish a VPN session on an affecte...

AlmaLinux 8 : sudo (ALSA-2026:75580)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:75580 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

Kibana 9.0.x < 9.4.7 / 9.5.x < 9.5.4 Incorrect Authorization (ESA-2026-187)

The version of Kibana installed on the remote host is 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-187 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data...

RockyLinux 10 : sudo (RLSA-2026:75579)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75579 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

AlmaLinux 9 : sudo (ALSA-2026:75571)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75571 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

Elasticsearch 9.0.x < 9.4.8 / 9.5.x < 9.5.5 Incorrect Authorization (ESA-2026-199)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-199 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information...

SUSE SLES15 Security Update : terraform-provider-susepubliccloud (SUSE-SU-2026:4444-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4444-1 advisory. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via...

Privilege Escalation / Access Control Bypass in Brocade Fabric OS account management interface (CVE-2026-94576)

: An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying...

Authentication & Authorization Bypass in Fibre Channel vendor-unique CT (Common Transport)

: A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrati...

PT-2026-106980

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the Network component allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page...

Oracle Linux 10 : sudo (ELSA-2026-75579)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-75579 advisory. - CVE-2026-96512 sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization rhel-10.2.z - Fix CVE-2026-82474: execveat2...

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 Authentifizierungsumgehung - Reproduktion Dieses Repository ist eine Reproduktion der CVE-2025-29927 Schwachstelle im next Paket Reproduktion 1. Befolgen Sie die untenstehenden Schritte, um die Next.js-Anwendung zu klonen und auszuführen. 2. Testen Sie, dass die Autorisierung den...

GHSA-5H3F-Q97H-CCVC vm2: NodeVM custom resolution bypasses external path boundaries

Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...

EUVD-2026-87858

vm2: NodeVM custom resolution bypasses external path boundaries...

CVE-2024-6678

CVE-2024-6678 - GitLab: Pipeline Schedule Arbitrary User Trigger PoC per CVE-2024-6678 Descrizione della vulnerabilità GitLab consente agli utenti di eseguire manualmente le pianificazioni dei pipeline CI/CD Pipeline Schedules tramite il pulsante «Play». La vulnerabilità consiste nel fatto che la...

LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 — Next.js Middleware / RSC-Bypass-Analyse Der Autor übernimmt keine Haftung für Missbrauch oder Schäden, die durch diese Forschung verursacht werden Ausschließlich zu Bildungs- und Verteidigungszwecken bereitgestellt Beschreibung Dieses Repository enthält ein klein...

CVE-2026-11991-Exploit

CVE-2026-11991 — FlowForms Unautorisierte Formularveröffentlichung Authentifizierte Contributor+ Autorisierungsumgehung zur Veröffentlichung beliebiger Entwurfsformulare in FlowForms ≤ 1.1.1 Schwachstellenübersicht Eigenschaft| Wert ---|--- CVE-ID| CVE-2026-11991 CVSS-Score| 6.2 — Mittel...