CVE-2026-12269

Zohocorp ManageEngine DDI Central version 6.2.0 (builds below 6201) is vulnerable to a Keepalived configuration injection vulnerability within the HA configuration workflow. An authenticated operator-level user can exploit this flaw to modify the Keepalived configuration, potentially leading to R...

EUVD-2026-88209

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...

CVE-2026-12269 Authenticated File Write to RCE via keepalived in DDI Central

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...

CVE-2026-19759

Google Cloud Application Integration versions prior to 2026-06-17 are affected by an Incorrect Authorization vulnerability in the task configuration. This flaw allows an authenticated Google Cloud user to execute arbitrary internal RPCs from within Google's production network under a privileged i...

CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

CVE-2026-82383

Apache Roller version 6.1.5 is vulnerable to a missing authentication flaw in a critical function. An unauthenticated remote attacker can persistently change site-global configuration values, specifically the frontpage weblog selection , because the setup action remains anonymously reachable afte...

CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

EUVD-2026-88138

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

CVE-2026-84653

A flaw was found in Jenkins. An attacker with Overall/Manage permission can exploit incorrect permission checks in the Appearance configuration page. This allows them to modify configuration options they should not have access to, potentially leading to unauthorized changes within the Jenkins...

CVE-2026-84651

A flaw was found in Jenkins. The system's application programming interface API and command-line interface CLI for managing agent configurations fail to properly validate the target agent. This vulnerability allows an attacker, who already has permissions to configure one agent, to overwrite the...

CVE-2026-84650

A flaw was found in Jenkins. Attackers capable of submitting configuration updates can exploit a deserialization vulnerability by specifying values for transient fields. Although these fields are normally excluded from serialization, they are still processed during deserialization, which can lead...

CVE-2026-84645

A flaw was found in Jenkins. This vulnerability allows a remote attacker to achieve remote code execution. By manipulating user-submitted configuration files, an attacker can exploit a deserialization weakness where specially crafted objects can process HTTP requests. This grants unauthorized...

PT-2026-99905

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 Description The Git webhook receiver the gitjob webhook service fails to verify incoming requests when a webhook secret is not configured. This allows a remote caller with network access to the...

PT-2026-99843

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6.2.0 build 6201 Description A configuration injection flaw exists in the High Availability HA configuration workflow. This issue allows an authenticated user with operator-level privileges to modify...

PT-2026-99899

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 5.0.0 through 5.0.9 Canonical LXD versions 5.1.0 through 5.21.7 Canonical LXD versions 6.0.0 through 6.9.9 Description Incorrect authorization in the custom storage volume creation endpoint allows an authenticated client...

PT-2026-99921

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 SUSE Rancher Fleet versions 0.15 through 0.15.6 SUSE Rancher Fleet versions 0.14 through 0.14.10 Description An issue exists in Rancher Manager where the Fleet agent utilizes its own cluster-admi...

CVE-2026-12269: Unrestricted Upload of File with Dangerous Type

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...

CVE-2026-97335: Incorrect Authorization

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later fixed in 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any...

CVE-2026-88808: Execution with Unnecessary Privileges

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...