python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

CVE-2026-77125

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

CVE-2026-75593

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially...

CVE-2026-77125 Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

CVE-2026-77125 Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

CVE-2026-77125

Sonatype Nexus Repository 3 contains an incorrect authorization flaw in two blobstore group management REST API endpoints . A user holding only the nexus:blobstores:create permission (which must be explicitly granted and is not default) could invoke these endpoints to convert an existing blobstor...

CVE-2026-77125 Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84653

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84653

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

EUVD-2026-70120

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84654

In Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6 ), which are included in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), a form data binding vulnerability exists. This flaw allows an attacker capable of submitting configuration forms to modify public static fields...

CVE-2024-7956

CVE-2024-7956 is an Incorrect Authorization (CWE-863) vulnerability in Rockwell Automation DataMosaix Private Cloud , versions 7.07 and prior . A threat actor with basic user privileges can gain unauthorized access to other users' projects and modify or delete them. The CVSS v3.1 base score is 8....

CVE-2024-7956 Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

CVE-2024-7956 Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

EUVD-2024-55748

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

CVE-2026-78609 Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in t...

CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...