CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...

CVE-2026-55703

Snipe-IT (IT asset/license management system) prior to 8.6.3 contains an authorization bypass in MaintenancesController::show(). The method renders a maintenance record without calling authorize(), unlike all sibling actions (index, edit, update, destroy) which properly gate on the asset. Any act...

EUVD-2026-62680

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

CVE-2026-72462

A flaw was found in the Linux kernel's AppArmor security module. A race condition exists in the Unix socket mediation when handling the peerpath. This allows for a race with unixreleasesock due to accessing the peer socket path outside of the necessary state lock. This could potentially lead to...

CVE-2026-60592

creationtimestamp| type| source ---|---|--- 2026-08-19 17:49:15+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-41424

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

CVE-2026-20358

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20315

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-50173

In Flow-Like before 1.0.4, the GET /api/v1/apps/{app_id}/invoke/presign route mints an Azure SAS token with sp=rwdl for any user holding only ExecuteEvents, even when they lack ReadFiles/WriteFiles. This lets low-privilege authenticated users directly write or delete blobs under the app content p...

CVE-2026-44256

Wazuh (open-source threat prevention, detection, and response platform) is vulnerable to CRLF log injection in its API access logger. In versions 4.4.0 through 4.14.6 and 5.0.0-beta2 , the file api/api/middlewares.py decodes the Basic-authentication username before credential validation and passe...

CVE-2026-20315

CVE-2026-20315 is a set of improper access control vulnerabilities (CWE-284) in Cisco Secure Workload , affecting both SaaS and on-premises deployments. The flaws span authorization, authentication, privilege escalation, and access control bypasses, carrying a CVSS 10.0 rating. They were discover...

CVE-2026-20315 Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

EUVD-2026-62570

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20358 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20358

Cisco Crosswork is affected by externally controlled file system issues (CWE-73), yielding a CVSS 10.0 CRITICAL score with high integrity and availability impact. No affected versions, patch details, or exploitation evidence are provided in the documents. Exploitation status is not available.

EUVD-2026-62566

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-41424

Wazuh (open-source threat detection and response platform) contains a privilege escalation vulnerability in the PUT /security/users/{user_id} API endpoint. The root cause is that security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user; the...

EUVD-2026-62564

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

CVE-2026-62673

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

CVE-2026-64852

In Grav API Plugin before 1.0.8, the apiKeyGenerate/apiKeyRevoke tasks in user/plugins/api/api.php authorize callers with only admin.login, allowing a basic panel user to forge API keys for any other account and inherit its permissions (including api.super). Fixed in version 1.0.8; no in-the-wild...