CVE-2026-50173

In Flow-Like before 1.0.4, the GET /api/v1/apps/{app_id}/invoke/presign route mints an Azure SAS token with sp=rwdl for any user holding only ExecuteEvents, even when they lack ReadFiles/WriteFiles. This lets low-privilege authenticated users directly write or delete blobs under the app content p...

CVE-2026-44256

Wazuh (open-source threat prevention, detection, and response platform) is vulnerable to CRLF log injection in its API access logger. In versions 4.4.0 through 4.14.6 and 5.0.0-beta2 , the file api/api/middlewares.py decodes the Basic-authentication username before credential validation and passe...

CVE-2026-20315

CVE-2026-20315 is a set of improper access control vulnerabilities (CWE-284) in Cisco Secure Workload , affecting both SaaS and on-premises deployments. The flaws span authorization, authentication, privilege escalation, and access control bypasses, carrying a CVSS 10.0 rating. They were discover...

CVE-2026-20315 Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

EUVD-2026-62570

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20358 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20358

Cisco Crosswork is affected by externally controlled file system issues (CWE-73), yielding a CVSS 10.0 CRITICAL score with high integrity and availability impact. No affected versions, patch details, or exploitation evidence are provided in the documents. Exploitation status is not available.

EUVD-2026-62566

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-41424

Wazuh (open-source threat detection and response platform) contains a privilege escalation vulnerability in the PUT /security/users/{user_id} API endpoint. The root cause is that security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user; the...

EUVD-2026-62564

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

CVE-2026-62673

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

CVE-2026-64852

In Grav API Plugin before 1.0.8, the apiKeyGenerate/apiKeyRevoke tasks in user/plugins/api/api.php authorize callers with only admin.login, allowing a basic panel user to forge API keys for any other account and inherit its permissions (including api.super). Fixed in version 1.0.8; no in-the-wild...

CVE-2026-62673 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

MINI-QVPR-M62V-FRX4

Bulletin has no description...

CVE-2026-62667 Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey stores a declared scopes array, but ApiKeyAuthenticator::authenticate does not read keyDatascopes and returns the owning user's...

EUVD-2026-62539

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...

CVE-2026-62666

Grav API Plugin (a RESTful API for Grav CMS) prior to 1.0.6 contains a privilege escalation flaw. The UsersController methods createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check that sibling user mutation endpoints enforce. A non-super account holding api.use...

CVE-2026-62666 Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-67267

Dell Command Update (DCU) versions prior to 5.7.1 are affected by an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low-privileged attacker with local access can exploit this flaw to achieve information disclosure , with no user interaction required. T...