CVE-2026-59902 vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, management-api-for-apache-cassandra-4.1, seata, trino, pinot-fips, apache-hop-fips, management-api-for-apache-cassandra-4.0, pinot, thingsboard, management-api-for-apache-cassandra-5.0, celeborn, tez...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: celeborn, tez, management-api-for-apache-cassandra-5.0, thingsboard, trino...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: tez, spark, apache-activemq-artemis, thingsboard, apache-pulsar, kserve-modelmesh, wildfly, akhq, management-api-for-apache-cassandra-5.0, neo4j, celeborn, infinispan, apicurio-registry, druid, keycloak, trino, opensearch, zipkin, wavefront-proxy, flyway, logstash,...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, apache-hop, seata, apache-hop-fips, thingsboard, management-api-for-apache-cassandra-5.0, tez...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: thingsboard, tez, management-api-for-apache-cassandra-5.0...

CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-55986

CVE-2026-55986 concerns an issue where the Email Management API bypasses ManageCredentials feature restrictions. The connected sources do not specify affected product/version or root cause beyond this description. CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N yields a base score of 5.4 (Me...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

PT-2026-71700

Name of the Vulnerable Software and Affected Versions Email Management API affected versions not specified Description The Email Management API contains a flaw that allows the bypass of restrictions within the ManageCredentials feature. Recommendations At the moment, there is no information about...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-18103

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...

CVE-2026-18103 Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...

Linux Distros Unpatched Vulnerability : CVE-2026-18103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not...

CLEANSTART-2026-IF92269 Security fixes in management-api-for-apache-cassandra-5.0 0.1.113-r1

Package management-api-for-apache-cassandra-5.0 version 0.1.113-r1 fixes 2 vulnerabilities: ghsa-84h7-rjj3-6jx4, ghsa-qqpg-mvqg-649v...

CLEANSTART-2026-LO26114 Security fixes in management-api-for-apache-cassandra-5.0 0.1.112-r0

Package management-api-for-apache-cassandra-5.0 version 0.1.112-r0 fixes 1 vulnerabilities: ghsa-84h7-rjj3-6jx4...

CLEANSTART-2026-NP47613 Security fixes in management-api-for-apache-cassandra-5.0 0.1.108-r0

Package management-api-for-apache-cassandra-5.0 version 0.1.108-r0 fixes 8 vulnerabilities: ghsa-4g8c-wm8x-jfhw, ghsa-jq43-27x9-3v86, ghsa-25qh-j22f-pwp8, ghsa-389x-839f-4rhx, ghsa-3p8m-j85q-pgmj...

CVE-2026-54693

CVE-2026-54693 affects Zitadel versions 2.43.0–2.71.19, 3.0.0–3.4.11, and 4.0.0–4.15.1. The vulnerability exists in the self-management API paths (internal/command/user_v2_email.go, internal/command/user_v2_phone.go, internal/command/user_v2_human.go), where verification codes could be requested ...

CVE-2026-54693 ZITADEL Users Can Self-Verify Email/Phone via API

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/userv2email.go, internal/command/userv2phone.go, and internal/command/userv2human.go allowed...