EUVD-2026-80119

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-8030 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-8030

CVE-2026-8030 is a Missing Authorization vulnerability in GitLab CE/EE affecting versions 13.0 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1 . The root cause is improper validation of group URL slugs during namespace transfers , which under certain conditions allowed an authenticat...

CVE-2026-8030: Missing Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

GitLab 13.0 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-8030)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...

CVE-2026-20121: Improper Access Control

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-86089: Missing Authorization

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

PT-2026-93330

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where improper validation of group URL slugs during namespace transfers could allow an...

SUSE SLES12 Security Update : kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:4192-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4192-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes one security issue: The following security issue was fixed: - CVE-2026-64423:...

CVE-2026-88817: Improper Privilege Management

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access t...

CVE-2026-18555: Improper Neutralization of Input During Web Page Generation

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-20120: Improper Access Control

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-82561: Missing Authorization

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

CVE-2026-92257

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious cod...

CVE-2026-92257 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious cod...

CVE-2026-68532

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...

CVE-2026-68532 Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...

CVE-2026-68532

Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to cross-site request forgery (CSRF) in the dashboard group type controller. The delete action did not validate a CSRF token, allowing a remote unauthenticated attacker to trick an authenticated user with group type management permissions i...

CVE-2026-68532 Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...

EUVD-2026-79026

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...