278303 matches found
ROS-20260918-73-0078
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260918-73-0074
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-95308
Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists in the netty-handler-ssl-ocsp component. A remote attacker can bypass security controls by providing an Online Certificate Status Protocol OCSP response that omits the optional...
CVE-2026-93759: Improper Control of Generation of Code
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...
EulerOS Virtualization 2.11.1 : httpd (EulerOS-SA-2026-3422)
According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...
CVE-2026-83944
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-83944
CVE-2026-83944 is an improper access control flaw in Azure Logic Apps that allows an unauthorized, remote attacker to elevate privileges over a network with no user interaction and no prior privileges required. The CNA-assigned CVSS 3.1 score is 10.0 (CRITICAL) with a scope change, impacting conf...
The End of Point-in-Time Compliance: Why Continuous Audit Readiness Matters to You in the AI Era
Key Takeaways Periodic audits provide a point-in-time assessment, but they cannot demonstrate whether controls remain effective between audit cycles. Qualys platform data shows 10.5 billion configuration findings across customer environments but only 1.6% represent meaningful exposure and under 1...
CVE-2026-54648
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...
Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition shipped with IBM Tivoli Monitoring.
Summary Multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. CVE-2026-61308, CVE-2026-70907 and CVE-2026-60589. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows...
grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API
A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...
grafana: Grafana: Temporary access control bypass for service account token minting
A flaw was found in Grafana. When a user's access to mint tokens for a service account is revoked, the system may temporarily allow the user to continue minting tokens for a few seconds. This could lead to a temporary bypass of access control, potentially enabling unauthorized actions if the toke...
grafana: Grafana: Temporary access control bypass for service account token minting
A flaw was found in Grafana. When a user's access to mint tokens for a service account is revoked, the system may temporarily allow the user to continue minting tokens for a few seconds. This could lead to a temporary bypass of access control, potentially enabling unauthorized actions if the toke...
grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API
A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...
CVE-2026-86863
A flaw was found in pgAdmin 4. When the 'webserver' authentication source is enabled, a remote attacker can bypass authentication by supplying a client-controlled identity header. This allows the attacker to authenticate as any user, including an Administrator, without providing valid credentials...
CVE-2026-90153
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
DEBIAN-CVE-2026-90060
In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that...
AZL-102021 CVE-2026-90060 affecting package kernel for versions less than 6.6.161.1-1
In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that...
EUVD-2026-82338
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...
CVE-2026-54677 Scoold: Authenticated user can post replies and comments to private-space questions without space membership
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply...