CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-71322

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...

EUVD-2026-61214

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-67442

FUXA (web-based SCADA/HMI/Dashboard) prior to 1.3.3 has a business-logic flaw in the DELETE /api/roles endpoint. When a role is deleted, the role identifier is not removed from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifi...

CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-47721

FUXA versions prior to 1.3.2 fail to enforce admin permissions on POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js, allowing authenticated non-admin operators to schedule actions invoking onSetValue or onRunScript, enabling PLC setpoint changes and server-side script...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 is affected by a missing authorization flaw in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. Unlike the sibling handler for GET /a/share/cell/{Uuid}, which enforces MatchPolicies with ResourcePolicyAction_READ, the link handler calls L...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

EUVD-2026-61205

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

AZL-96770 CVE-2026-65959 affecting package vitess 19.0.4-12

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-71322 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...

EUVD-2026-61157

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-71307

In Lemur before 1.9.3, GET /api/1/destinations endpoints required only basic authentication, allowing low-privilege users to read plaintext SFTP passwords and private-key passphrases stored by the sftp-destination plugin. CVSS 7.7 HIGH (network, low complexity). Fixed in 1.9.3 by requiring admin ...

EUVD-2026-61152

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces or replacements identifiers that AssociatedCertificateSchema resolved with fetchobjects without a CertificatePermission check. Assigning those objects to...

CVE-2026-72261

A flaw was found in the Linux kernel's Sound Open Firmware SOF subsystem, specifically within the ipc3-control component. This vulnerability occurs in the sndsofupdatecontrol function where the size of firmware-provided data is not properly validated against the allocated buffer size. An attacker...

CVE-2026-13221

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...

CVE-2026-66780

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...