EEF-CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Summary Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic...

PT-2026-84434

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...

Debian dla-4766 : cyrus-admin - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4766 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected]...

MiracleLinux 9 : nginx:1.26 (AXSA:2026-1722:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1722:01 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...

PT-2026-84386

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

AlmaLinux 9 : nginx:1.26 (ALSA-2026:59496)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:59496 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service ...

CVE-2026-73764: Improper Authentication

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of...

PT-2026-84482

Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description Issues in the operating system of AOS-CX switches may allow an unauthenticated remote actor to bypass authentication controls. This could lead to the unauthorized modification of...

PT-2026-84451

A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user with local access to elevate their user privileges and make limited modifications on the affected system...

PT-2026-84414

Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to make limited unauthorized modifications to the underlying operating system and disrupt the...

CVE-2026-73774: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure ...

CVE-2026-19591: Improper Neutralization of Escape, Meta, or Control Sequences

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token --% differently than PowerShell itself. If a user opens an attacker-prepared...

CVE-2026-73180

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

CVE-2026-73819

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in the IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs: CVE-2026-47027, CVE-2026-47063, CVE-2026-60147 Vulnerability Details CVEID:CVE-2026-47063 DESCRIPTION: Easily exploitable vulnerabilit...

CVE-2026-77966

CVE-2026-77966 affects the Ebyte NA111-M , a CISA ICS-listed product, where missing authorization fails to separate limited and administrative management functions. A low-privileged authenticated attacker can access security-sensitive configuration functions and modify settings that impact the de...

EUVD-2026-68613

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

CVE-2026-77966 Ebyte NA111-M Missing Authorization

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

CVE-2026-73819

Ebyte NE2-D11 (and NA111-M ) vendor configuration utility contains a weak authentication flaw: under certain credential conditions, administrative functions are accessible without verifying the operator's identity. An unauthenticated attacker on the adjacent network could modify critical settings...

CVE-2026-73819 Ebyte NA111-M Weak Authentication

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...