Important: acl security update

Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fixes: acl: Symlink traversal privilege escalation via libacl function...

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations...

PT-2026-61927

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

PT-2026-61932

Name of the Vulnerable Software and Affected Versions FlexCity versions 5.536.0 through 5.541.0 Description Missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update FlexCity to version 5.542.0 or later...

PT-2026-63062

Name of the Vulnerable Software and Affected Versions Oracle Agile Product Lifecycle Management for Process version 6.2.4 Description An issue exists in the Installation component of the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain. An unauthenticated...

SolarWinds Serv-U 15.5.4 < 2026.3 Multiple Vulnerabilities XSS

The version of SolarWinds Serv-U installed on the remote host is prior to 2026.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsserv-u20263 advisory. - SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead...

The vulnerability of the upload component in the /photo_center/php/uploadify.php file of the D-Link DNS-320 network storage software allows a hacker to cause a service failure.

The vulnerability of the /photocenter/php/uploadify.php component in the D-Link DNS-320 network storage software is related to errors in access control when processing the “Malicious Handler” parameter. Exploiting this vulnerability allows an attacker to cause service failures...

acl security update

2.4.0-1 - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions RHEL-186111 - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl RHEL-186216...

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

This is a cross-repository IDOR / broken access control issue. An attacker can tamper with issue-tracking state dependency relationships and inject an attacker-authored comment into a private repository they cannot otherwise read or write to, crossing a trust boundary the "add" path explicitly...

PT-2026-61983

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

acl-2.4.0-1.1 on GA media (moderate)

acl-2.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11312-1 Rating: moderate Cross-References: CVE-2026-54369 CVE-2026-54370 CVE-2026-54371 CVSS scores: CVE-2026-54369 SUSE : 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-54369 SUSE : 8.8...

ALSA-2026:42736 Important: acl security update

Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fixes: acl: Symlink traversal privilege escalation via libacl function...

PT-2026-61968

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description Broken access control allows a domain administrator to create system administrator accounts. The impact of this issue is lower in Windows deployments. Recommendations At the moment,...

PT-2026-62049

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An Unintended Proxy or Intermediary issue, also known as a Confused Deputy, occurs when a lower-privileged user can manipulate the system to process data from unauthorized sources using the...

PT-2026-62094

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Improper Access Control allows a low-privileged authenticated user with read-only Security Solution access to perform write operations on Entity Analytics Watchlist configuration, which should...

PT-2026-61976

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description Broken access control allows arbitrary file read and write operations. This flaw can be leveraged to escalate privileges and execute code as root. Exploitation requires domain...

PT-2026-61829

Name of the Vulnerable Software and Affected Versions kronosnet versions prior to 1.35 Description An issue exists in the internal Access Control List ACL subsystem. When the framework is configured to manage dynamic links to accept network traffic from any IP address without network payload...

PT-2026-63289

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authorization issue exists in the organization-level Actions REST endpoints. The endpoints /api/v1/orgs/org/actions/runs and /api/v1/orgs/org/actions/jobs only verify organization membership...

RHEL 10 : acl (RHSA-2026:42739)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42739 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain...

RHEL 9 : acl (RHSA-2026:42736)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42736 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain t...