CVE-2026-65011 Graylog2 Server Missing Permission Check on Event Definition Duplicate

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...

EUVD-2026-47743

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...

CVE-2026-65011

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-65011 Graylog2 Server Missing Permission Check on Event Definition Duplicate

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...

CVE-2026-65011 Graylog2 Server Missing Permission Check on Event Definition Duplicate

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...

CVE-2026-44879

creationtimestamp| type| source ---|---|--- 2026-07-22 14:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mraldxwopq2n...

CVE-2026-55991

creationtimestamp| type| source ---|---|--- 2026-07-22 13:52:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrahuibum52s...

CVE-2026-16544

AWX security issue: the websocket event consumer omits RBAC checks for inventory_update_events, project_update_events, and system_job_events, allowing any authenticated user to subscribe to these unmapped groups and view real-time stdout from jobs in other organizations. Affected component is the...

EUVD-2026-47629

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

GHSA-9WJQ-CP2P-HRGF

creationtimestamp| type| source ---|---|--- 2026-07-22 08:30:36+00:00| seen| https://gist.github.com/alon710/cd896a69a4be919308bb443d6cb706e0...

CVE-2026-63047 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.0 Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period...

Security Bulletin: Multiple Vulnerabilities in IBM Event Processing

Summary Multiple vulnerabilities were addressed. Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data via JSON...

CVE-2026-63144

creationtimestamp| type| source ---|---|--- 2026-07-22 02:55:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7d42ptqm2g...

CVE-2026-8985

creationtimestamp| type| source ---|---|--- 2026-07-22 02:01:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7a3gina72s 2026-07-22 17:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mratv7bbrw2e...

CVE-2026-62546

creationtimestamp| type| source ---|---|--- 2026-07-22 01:43:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr773trwh72i 2026-07-22 16:42:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrarcxmbpu23 2026-07-23 18:20:51+00:00| seen|...

PT-2026-63545

Summary Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data e.g., HTTP requests to a revoked server before the channel is closed by the OC...

CVE-2026-60280

creationtimestamp| type| source ---|---|--- 2026-07-21 23:40:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6y7itcfn2a 2026-07-23 16:50:36+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-25 17:37:06+00:00| seen|...

CVE-2026-60522

creationtimestamp| type| source ---|---|--- 2026-07-21 23:13:15+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mr6wphsmwz2l 2026-07-23 17:18:30+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...