CVE-2026-55774 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...

CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...

EUVD-2026-78663

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-54076 ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-54076 ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-54076 ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495

moment (a JavaScript date library) versions 2.29.2 through 2.30.1 are vulnerable to a path traversal via a specially crafted non-string object passed to moment.locale(). The guard assumes string input, so an object whose match() method satisfies the check while toString() returns a traversal path...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

Linux Distros Unpatched Vulnerability : CVE-2026-17495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-stri...

PT-2026-91861

Name of the Vulnerable Software and Affected Versions moment versions 2.29.2 through 2.30.1 Description A path-traversal issue exists when a specially crafted non-string object is passed to the moment.locale function. The internal guard assumes the input is a string; however, an object with a mat...

Linux Distros Unpatched Vulnerability : CVE-2026-91991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalize...

CVE-2026-55847

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...

CVE-2026-55847

Allure 2 (a multi-language test reporting tool) is vulnerable to stored XSS in the ansi.js Handlebars helper within allure-generator. Prior to 2.39.0 , attacker-controlled statusMessage and statusTrace values (sourced from JUnit XML, TRX, xUnit, xctest, or Allure1/2 plugins) are passed through th...

EUVD-2026-77688

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...

CVE-2026-55847 Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...