CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: thingsboard, management-api-for-apache-cassandra-5.0, apache-hop-fips, tez, seata, tinkerpop, hadoop-fips, apache-hop...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: tez, thingsboard, management-api-for-apache-cassandra-5.0...

CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986

The Gitea Git repository management platform is vulnerable to an access control deficiency in its Email Management API . This flaw allows an attacker to bypass restrictions within the ManageCredentials feature, potentially leading to privilege escalation remotely. While specific affected versions...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

CVE-2026-55986: Improper Access Control

Email Management API Bypasses ManageCredentials Feature Restrictions...

PT-2026-71700

Name of the Vulnerable Software and Affected Versions Email Management API affected versions not specified Description The Email Management API contains a flaw that allows the bypass of restrictions within the ManageCredentials feature. Recommendations At the moment, there is no information about...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-69115

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...

CVE-2026-69115: Missing Authorization

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...

Clerk / Auth0 Management API Enumeration

Uses leaked Clerk secret keys or Auth0 client credentials to enumerate users via Management APIs. Auto-discovers credentials from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Clerk and Auth0 Management APIs using leaked secret keys. Follow-up for...

Contentful Management API Enumeration

Uses leaked CFPAT management tokens and space IDs to list Contentful spaces and sample entries. Auto-discovers credentials from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Contentful spaces and entries using leaked management tokens.""" from kittysploit import from...

Neon Database URL Validation

Parses leaked Neon postgres:// URLs .neon.tech and validates Neon Management API keys against /api/v2/projects. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Validate leaked Neon database URLs and Management API keys.""" from kittysploit import from...

SUSE CVE-2026-18103

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...

MAL-2026-13102 Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...

CVE-2026-18103

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...