30884 matches found
CVE-2026-71299: Missing Authentication for Critical Function
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...
PT-2026-106037
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...
CVE-2026-104966: Authorization Bypass Through User-Controlled Key
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...
PT-2026-106022
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group by and sub group by query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .order byfield...
CVE-2026-104969: Authorization Bypass Through User-Controlled Key
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...
firefox-esr-153.4.0-1.1 on GA media (moderate)
firefox-esr-153.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11917-1 Rating: moderate Cross-References: CVE-2026-100756 CVE-2026-100757 CVE-2026-100758 CVE-2026-100759 CVE-2026-100760 CVE-2026-100762 CVE-2026-100765 CVE-2026-100766 CVE-2026-100767 CVE-2026-100769 CVE-2026-100770...
EUVD-2026-91132
This vulnerability enables unauthenticated remote code execution RCE on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an...
CVE-2026-18397
This vulnerability enables unauthenticated remote code execution RCE on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an...
CVE-2026-18397
The SConnect native host component is vulnerable to unauthenticated remote code execution (RCE) . The flaw stems from a combination of cryptographic weaknesses and memory management issues , where an unrestricted messaging interface between an attacker-controlled web page and the native host allo...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2024-53677, CVE-2025-23184)
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2024-53677 DESCRIPTION: File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this ca...
SUSE-SU-2026:22711-1 Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-37.1 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...
CVE-2026-103491
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...
CVE-2026-103488
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...
CVE-2026-103491
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...
CVE-2026-103491
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...
CVE-2026-103491
JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the issue activities API . This vulnerability allows an attacker to read restricted issues that they should not have access to. The base CVSS score is 6.5 (MEDIUM) , indicati...
EUVD-2026-90582
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...
CVE-2026-103488
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...