CVE-2026-72508

The CVE-2026-72508 issue affects the multicloud-operators-subscription component in Red Hat Advanced Cluster Management (RHACM). A namespace-admin tenant can perform a confused‑deputy attack by creating Subscription Custom Resources that leverage a highly privileged ServiceAccount, enabling deplo...

CVE-2026-72508 Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

EUVD-2026-57375

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

EUVD-2026-57371

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-73298

The CVE-2026-73298 entry concerns the Microsoft Container Migration Solution Accelerator (multi-service AI-driven migration tool) with vulnerability in version 2.1.2 and earlier. The issue is an authenticated IDOR (Insecure Direct Object Reference) that permits reading, writing, and deleting proc...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-16904

CVE-2026-16904 (IBM i) affects IBM i 7.3–7.6. A remote authenticated attacker could execute arbitrary commands due to improper privilege management during monitor owner reassignment. CVSSv3.1 base score 8.1 (High): vectors include AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; privileges required: LOW; net...

CVE-2026-16904 IBM i is Affected By improper privilege management in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

EUVD-2026-57358

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

CVE-2026-73294

Semaphore UI prior to versions 2.18.17 and 2.19.5-beta2 is affected by an OS command injection in the repository git_url handling. The flaw allows an attacker with project Manager/Owner privileges to influence CmdGitClient.GetLastRemoteCommitHash via a crafted --upload-pack option sent through PO...

CVE-2026-68441

A flaw was found in the Linux kernel's networking scheduler net/sched. When a Traffic Control TC filter, configured with an eBPF program or actbpf action, attempts to redirect a packet, the redirection is silently ignored. This causes the packet to be processed normally instead of being redirecte...

CVE-2026-66376

Credentials for a deleted user may remain valid for a short period under specific conditions...

CVE-2026-50561

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

EUVD-2026-57241

Credentials for a deleted user may remain valid for a short period under specific conditions...

CVE-2026-66376 Deleted users may temporarily retain access to JFrog Artifactory

Credentials for a deleted user may remain valid for a short period under specific conditions...

CVE-2026-47229

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

EUVD-2026-57205

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...