CVE-2026-55163 Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership

Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermissionroleid, which allowed either an administrator or any existing member of the target role. The handler passed data"users" and data"name" to service.updat...

BASM (Broken Authentication & Session Management) in Jira Service Management Data Center

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 10.3.0, and 11.3.0 of Jira Service Management Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an...

CVE-2026-24183

The Initial Description provides concrete technical details: the affected product is NVIDIA Cumulus Linux, the vulnerable component is the user management module, the root cause is improper privilege management, and the impact is local privilege escalation (CVSS 7.8 HIGH). No fix version or explo...

CVE-2026-24183

NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege management on the system. A successful exploit of this vulnerability might lead to escalation of privileges...

EUVD-2026-61103

NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege management on the system. A successful exploit of this vulnerability might lead to escalation of privileges...

CVE-2026-68923 MobSF: CSRF checks not enforced after Django migration

MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963

The keycloak-services reset-credentials flow in Red Hat Build of Keycloak allows an unauthenticated attacker to bypass email verification and directly set new credentials for any user, enabling full account takeover (CVSS 9.1 Critical). No affected version or patch details are provided. No exploi...

EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.5.2

Logging for Red Hat OpenShift - 6.5.2 Red Hat OpenShift Logging 6.5.2 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-72213

A flaw was found in the Linux kernel's huge page memory management hugetlb. A mismatch in how reserved and non-reserved huge page control group cgroup charges are handled during memory allocation and deallocation can lead to an incorrect cgroup being uncharged. This issue results in a page counte...

EUVD-2026-61038

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-49226

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...

CVE-2026-49227

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and...

EUVD-2026-61035

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

EUVD-2026-61027

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

CVE-2026-49226

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...

CVE-2026-49226 Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...