CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: apache-hop-fips, seata, celeborn, tinkerpop, tez, management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1, hadoop-fips, trino, pinot-fips, pinot, thingsboard, management-api-for-apache-cassandra-4.0...

CVE-2026-59902 vulnerabilities

Vulnerabilities for packages: apache-hop-fips, seata, celeborn, tinkerpop, tez, management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1, hadoop-fips, trino, pinot-fips, pinot, thingsboard, management-api-for-apache-cassandra-4.0...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: thingsboard, trino, celeborn, tez, management-api-for-apache-cassandra-5.0...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: opensearch, keycloak, wavefront-proxy, apache-activemq-artemis, apicurio-registry, apache-pulsar, celeborn, tez, logstash, kserve-modelmesh, thingsboard, neo4j, spark, akhq, infinispan, wildfly, druid, trino, strimzi-kafka-operator,...

CVE-2026-76761: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

PT-2026-78861

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: apache-hop, seata, apache-hop-fips, tinkerpop, tez, management-api-for-apache-cassandra-5.0, hadoop-fips, thingsboard...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: thingsboard, tez, management-api-for-apache-cassandra-5.0...

CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986

The Gitea Git repository management platform is vulnerable to an access control deficiency in its Email Management API . This flaw allows an attacker to bypass restrictions within the ManageCredentials feature, potentially leading to privilege escalation remotely. While specific affected versions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

PT-2026-71700

Name of the Vulnerable Software and Affected Versions Email Management API affected versions not specified Description The Email Management API contains a flaw that allows the bypass of restrictions within the ManageCredentials feature. Recommendations At the moment, there is no information about...

CVE-2026-55986: Improper Access Control

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...