CVE-2026-19014

CVE-2026-19014 affects Consul Community Edition and Consul Enterprise 1.17.0–2.0.2, where an uncontrolled resource consumption in the Connect authorization endpoint can grow the agent’s intention-match cache beyond bounds, bypassing cache-disable settings. Fixed in Consul 2.0.3 and Consul Enterpr...

CVE-2026-19014

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

CVE-2026-19014 Uncontrolled resource consumption in the Consul Connect authorization endpoint

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

CVE-2026-19014 Uncontrolled resource consumption in the Consul Connect authorization endpoint

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

CVE-2026-19016 Authorization bypass for session deletion in the transaction API

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016 Authorization bypass for session deletion in the transaction API

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016

Affected software: Consul Community Edition and Consul Enterprise (versions 1.19.1–2.0.2). Issue: Authorization bypass for session deletion via the transaction API. The vulnerability arises because the session:write ACL permission was not enforced for session deletion operations through the trans...

CVE-2026-19016 Authorization bypass for session deletion in the transaction API

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

Multiple vulnerabilities impacting HashiCorp Consul

Summary Consul Community Edition and Consul Enterprise are affected by eight vulnerabilities. CVE-2026-19012 is an authenticated denial of service in the Enterprise-to-Community Edition downgrade path. CVE-2026-19014 is an uncontrolled resource consumption issue in the Connect authorization...

CVE-2026-17594

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

EUVD-2026-54520

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

CVE-2026-17594

CVE-2026-17594 affects Nexus Repository 3 CE/Pro versions 3.0.0–3.94.x. The root cause is an authorization mismatch in the repository-creation UI: a delegated repository-admin (scoped to a specific format) could cause a repository of a different, unauthorized format to be created because authoriz...

CVE-2026-17594 Nexus Repository 3 - Authorization Bypass in Repository Creation

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

CVE-2026-17601

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment...

CVE-2026-17601 Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment...

CVE-2026-50629

A flaw was found in apache-cxf. The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without proper sanitization. A remote attacker could exploit this by injecting arbitrary content, including fake log entries, into the server's log...

CVE-2026-54201

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through...

EUVD-2026-54433

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through...

CVE-2026-54201 TeamDavid: Missing Authorization

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through...

CVE-2026-54201

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through...