CVE-2026-65926 Private Release Bundle versions may be disclosed under specific configurations

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-66384

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

CVE-2026-66384

JFrog Artifactory is affected by an improper limitation of a pathname to a restricted directory , allowing an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. The vulnerability carries a CVSS score of 5.3 (MEDIUM) with high integ...

CVE-2026-66375 Low-privilege users may remove protected Artifactory metadata

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions...

EUVD-2026-57254

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions...

EUVD-2026-57252

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

CVE-2026-68756

CVE-2026-68756 concerns a potential insecure deserialization in JFrog Artifactory. The CVE records indicate that a party with write access to stored session data may affect Artifactory under specific conditions. Connected sources (CVELIST) label the issue as potential insecure deserialization; no...

CVE-2026-68756 Potential insecure deserialization in JFrog Artifactory

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

CLSA-2026-1786547094 TuxCare security update for org.springframework.data:spring-data-ldap (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

CVE-2026-68755 Bundle writers may alter trusted release information in JFrog Artifactory

A bundle writer may create misleading release promotion information under specific conditions...

ECHO-8274-3DD3-6490

Bulletin has no description...

CVE-2026-73288 RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

ECHO-1A92-FEB4-84CA

Bulletin has no description...

CVE-2026-73265

Vulnerability (CVE-2026-73265) : In RustFS, the GetObject/CopyObject/UploadPartCopy paths incorrectly authorize reads of historical versions using s3:GetObject instead of s3:GetObjectVersion, enabling principals without historical-version permissions to disclose known historical content. This aff...

CVE-2026-16999

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17...

CVE-2026-47233

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

EUVD-2026-57212

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17...

CVE-2026-16999 XXE in Ministry of Justice's UYAP Document Editor

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17...

CVE-2026-16999

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17...