EUVD-2026-57633

The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

Linux Distros Unpatched Vulnerability : CVE-2026-63295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is...

Linux Distros Unpatched Vulnerability : CVE-2026-63299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify...

PT-2026-71764

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...

PT-2026-71514

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

PT-2026-71489

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL...

PT-2026-71490

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Missing authorization in logical decoding allows a...

PT-2026-71832

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2 Description Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. The addGoogleStrategy function in apps/webapp/app/services/googleAuth.server.ts passes a Google profile...

Linux Distros Unpatched Vulnerability : CVE-2026-72585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required...

Linux Distros Unpatched Vulnerability : CVE-2026-62420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance...

Linux Distros Unpatched Vulnerability : CVE-2026-63297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project...

PT-2026-71769

Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...

PT-2026-71777

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...

PT-2026-71701

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...

PT-2026-71833

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.6 Description An issue exists in the platform for building and deploying managed AI agents and workflows. The endpoint "/api/v1/deployments/:deploymentId/background-workers" invokes the...

PT-2026-71663

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

PT-2026-71611

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...

Linux Distros Unpatched Vulnerability : CVE-2026-29036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c tha...

PT-2026-71752

Name of the Vulnerable Software and Affected Versions Kibana Fleet affected versions not specified Description Incorrect Authorization in Kibana Fleet allows for privilege escalation through privilege abuse. The system restricts certain users to managing integration policies for a single specific...