CVE-2026-72831 Grav through 2.0.11 Authentication Bypass via Flex Objects

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

CVE-2026-22555

A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...

GO-2024-2939 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2024-2716 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2023-2166 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2025-3565 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...

GO-2023-2166 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2023-2133 vulnerabilities

Vulnerabilities for packages: nats...

GO-2026-4423 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

SUSE-SU-2026:23157-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

CVE-2026-19784

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 i...

EUVD-2026-58568

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 i...

CVE-2026-19784 francoisjacquet RosarioSIS Referrals.php DBUpdate authorization

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 i...

CVE-2026-19784 francoisjacquet RosarioSIS Referrals.php DBUpdate authorization

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 i...

CVE-2026-19784

RosarioSIS (francoisjacquet) is affected up to version 12.8. The vulnerability lies in the DBUpdate function of Discipline/Referrals.php, enabling an authorization bypass that can be triggered remotely. An exploit has been published and may be used in the wild. Mitigation is upgrading to version ...

EUVD-2026-58505

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELFHOSTED or DISABLEACCOUNTPORTAL set, the cloudRestricted middleware is a no-op and the route is protected only by a...

PT-2026-72041

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...

PT-2026-72119

OpenStack Octavia through 18.0.0 mishandles quality of service QoS policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected...

RHEL 8 : Red Hat OpenStack Platform 16.2 security advisory (Important) (RHSA-2026:54757)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54757 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

PT-2026-72000

Name of the Vulnerable Software and Affected Versions Flex Objects versions 1.0.0 through 1.4.6 Description An incorrect authorization issue exists in the Flex Objects API. The FlexApiController::update function only verifies general Flex directory permissions and fails to apply the target, field...