121605 matches found
PT-2026-114885
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...
CVE-2026-105040: Authorization Bypass Through User-Controlled Key
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...
PT-2026-115200
Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2024.3.14, 2025.0.11, and 2026.0.1 OpenNMS Horizon versions prior to 36.0.5 Description An authorization bypass exists in the REST API due to improper configuration of Spring Security filter chains. The /rest...
CVE-2026-111092: Missing Authorization
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands...
CVE-2026-111366: Authorization Bypass Through User-Controlled Key
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user: permissions can call /admin/sys/user/info, update, or delete to read records,...
GitLab 15.1 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-5954)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to...
Unity Linux 20.1070e Security Update: policycoreutils (UTSA-2026-130390)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130390 advisory. A Missing Authorization vulnerability in selinux policycoreutils seunshares allows auser that is running in unconfined context to kill e.g. root-owned processes...
GitLab 18.7 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-16301)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...
Security Updates for Skype for Business (October 2026)
The Microsoft Skype for Business installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network. CVE-2026-70297 -...
GitLab 17.6 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-103549)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...
Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130384)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130384 advisory. Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified...
CVE-2026-105039: Missing Authorization
EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...
GitLab 18.9 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-82632)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...
CVE-2026-111346: Authorization Bypass Through User-Controlled Key
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and...
CVE-2026-111169: Authorization Bypass Through User-Controlled Key
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resourceid, inserting comments...
PT-2026-114772
The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-44084: Authorization Bypass Through User-Controlled Key
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...
CVE-2026-76184: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...
traefik -- Multiple vulnerabilities
The traefik project releases a new version addressing multiple vulnerabilities: GHSA-p8wx-ph99-xgcr mTLS auth-tls-secret silently disabled for a host GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader GHSA-28hp-c82p-8vqj TLS-option cache hit skips the cross-namespace authorization check...
CVE-2026-111352: Incorrect Authorization
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...