PT-2026-71998

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API-key scope-cap bypass exists in the create and update methods of the UsersController. While these methods enforce scope caps for api.users.write, they rely on a...

PT-2026-71997

Name of the Vulnerable Software and Affected Versions Grav Plugin API getgrav/grav-plugin-api versions prior to 1.0.13 Description An issue exists in the InvitationsController where API-key scope caps are not properly enforced. The system uses a basic isSuperAdmin check instead of a scope-aware...

PT-2026-72025

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

Linux Distros Unpatched Vulnerability : CVE-2026-67990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An...

CVE-2026-19871: Use of Hard-coded Credentials

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

CVE-2026-19761: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...

CVE-2026-19757: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

CVE-2026-19761

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...

CVE-2026-19757 Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

CVE-2026-19757

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266 Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266

CVE-2026-73266 affects the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can manipulate ClusterClaim labels to force a cluster to join a ManagedClusterSet owned by another tenant, enabling cross-tenant access and the potential injection of policies and w...

CVE-2026-73266 Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

EUVD-2026-58132

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

SUSE CVE-2026-68389

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CLEANSTART-2026-IZ22023 Security fixes in flux-image-automation-controller 1.2.1-r1

Package flux-image-automation-controller version 1.2.1-r1 fixes 13 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-PM77605 Security fixes in flux-notification-controller-fips 1.9.2-r0

Package flux-notification-controller-fips version 1.9.2-r0 fixes 6 vulnerabilities: CVE-2023-3955, CVE-2023-3676, CVE-2019-11250, ghsa-gcjh-h69q-9w9g, ghsa-259r-337f-4rfw...