CVE-2026-61487 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...

EUVD-2026-49767

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

CVE-2026-65617

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions...

CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

CVE-2026-65603

Summary: Grav Login Plugin for Grav (grav-plugin-login)

EUVD-2026-47241

Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Inventory...

PT-2026-63463

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low privileges can perform unauthorized reads and writes on data protected by role-based query-level access controls. This occurs due ...

CVE-2026-60144

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Workflow execut...

CVE-2026-47047

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

EUVD-2026-46403

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

EUVD-2026-46388

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...

CVE-2026-63139

CVE-2026-63139 describes an Uncontrolled Resource Consumption (CWE-400) in Kibana, specifically targeting the Canvas functionality. An authenticated low-privilege user can trigger a specially crafted request that causes excessive allocation, leading to the Kibana server process termination and a ...

PT-2026-62094

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Improper Access Control allows a low-privileged authenticated user with read-only Security Solution access to perform write operations on Entity Analytics Watchlist configuration, which should...

CVE-2026-45703

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the wordexport feature permission and directly resolves attacker-controlled type/id input...

CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the wordexport feature permission and directly resolves attacker-controlled type/id input...

CVE-2026-48014

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

CVE-2026-63100 Maybe 0.6.0 Missing Authorization via HostingsController show/update

Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the beforeaction ensureadmin filte...

CVE-2026-62764

CVE-2026-62764 affects Apache Accumulo 2.1.4 and 2.1.5. An authenticated, low-privilege user without system permissions can remotely issue a command to gracefully shutdown several components (e.g., compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), causing a denial of ...

CVE-2026-45334

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the requesting user's access permissions. Kirby's Panel includes a content-locking feature that records which user currently has a model...

CVE-2026-59235 Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts

Missing Authorization CWE-862 in BankAccountListController app/Http/Controllers/Api/BankAccount/BankAccountListController.php, exposed at GET /api/bank-account, in Prospero Flow CRM companyid-get, performing only company scoping and no role or permission check before returning the data. This...