5956 matches found
CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
PT-2026-76813
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py t...
PT-2026-76829
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...
PT-2026-76700
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.17917 Description An issue exists that allows the unauthorized transfer of projects between organizations. Recommendations Update to version 2026.2.17917...
The vulnerability of the ath12k_ce_free_pipes() function in the drivers/net/wireless/ath/ath12k/ce.c driver for Atheros/Qualcomm wireless communication adapters in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the ath12kcefreepipes function in the drivers/net/wireless/ath/ath12k/ce.c driver for Atheros/Qualcomm wireless communication adapters in the Linux operating system is related to incorrect assumptions regarding the organization of data or memory. Exploiting this vulnerability...
PT-2026-76814
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...
CVE-2026-58433
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...
CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
CVE-2026-58417
REST API exposes organization membership of private organizations to public...
CVE-2026-58433
Technical details for CVE-2026-58433 are not publicly available in the provided documents. Monitor for updates as new information is published.
CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...
CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...
CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...
CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
CVE-2026-58429
CVE-2026-58429 affects Gitea: Public-Only Personal Access Tokens scope bypass in Organization and Permission Endpoints. Public-PAT scope bypass indicates an access-control deficiency at the organization/permission boundary, enabling a token with restricted privileges to access operations that sho...