5995 matches found
UBUNTU-CVE-2026-11817
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...
CVE-2026-11817
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...
CVE-2026-11817 CVE-2026-11817 CVE Record
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...
EUVD-2026-60476
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...
CVE-2026-45790 Dokploy: Invitation Role Escalation Allows Organization Takeover
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...
CVE-2026-45790
In Dokploy versions prior to 0.29.6, a user with only member:create permission could invoke the organization.inviteMember tRPC procedure to invite an account with the owner role, and packages/server/src/services/user.ts allowed creating accounts with arbitrary roles. Since owner roles cannot be d...
CVE-2026-45790 Dokploy: Invitation Role Escalation Allows Organization Takeover
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...
CVE-2026-44846
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...
CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...
CVE-2026-44846
JumpServer (open-source bastion host) has a privilege escalation flaw in apps/users/api/user.py: a user with users.invite_user permission can POST to /api/v1/users/users/invite/ with an existing member, triggering user.org_roles.set(org_roles) which overwrites that member's org roles—escalating p...
CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
PT-2026-76813
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py t...
PT-2026-76700
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.17917 Description An issue exists that allows the unauthorized transfer of projects between organizations. Recommendations Update to version 2026.2.17917...
PT-2026-76829
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description In deployments configured with multiple organizations, an Org Admin of a single organization can access permission data from other organizations. This occurs when calling the 'GET...
The vulnerability of the ath12k_ce_free_pipes() function in the drivers/net/wireless/ath/ath12k/ce.c driver for Atheros/Qualcomm wireless communication adapters in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the ath12kcefreepipes function in the drivers/net/wireless/ath/ath12k/ce.c driver for Atheros/Qualcomm wireless communication adapters in the Linux operating system is related to incorrect assumptions regarding the organization of data or memory. Exploiting this vulnerability...
PT-2026-76814
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...