bulwark

An organizational asset and vulnerability management tool, with Jira integration, designed for generating application security reports. Features Multi-client Vulnerability Management Security Report Generation Jira Integration Team-based Roles Authorization API Key & Management Email Integration...

webstor

WebStor Fast Identification of Vulnerable Web Technologies in your Organization WebStor is a tool implemented in Python under the MIT license for quickly enumerating all websites across all of your organization's networks, storing their responses, and querying for known web technologies and...

guac

GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...

EUVD-2026-96560

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests t...

CVE-2026-108621

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController edit handler. This vulnerability allows any authenticated user to modify organizational positions by sending PUT or POST requests to the /sys/position/edit endpoint. A low-privileged attac...

CVE-2026-108621 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests t...

CVE-2026-108620

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysPositionController deleteBatch handler. This vulnerability allows any authenticated user to delete organizational positions by sending comma-separated position IDs. Attackers can first obtain the...

CVE-2026-108620 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint,...

Backstage has improper authorization in GitLab organizational user ingestion

Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...

GHSA-GP6M-X9VW-5C5X Backstage has improper authorization in GitLab organizational user ingestion

Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...

CVE-2026-106463

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

PT-2026-107266

Name of the Vulnerable Software and Affected Versions @backstage/plugin-catalog-backend-module-gitlab versions prior to 0.8.7 Description Improper authorization exists during GitLab organizational user ingestion. Deployments that enable GitLab organization event ingestion and use scoped catalog...

CVE-2026-25706 yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.6.3. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

SUSE-SU-2026:3893-1 Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 3.3.22. - CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775...

Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: Update to version 3.1.25. CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776. Patch Instructions: To install this SUSE update use the SUS...

SUSE-SU-2026:3890-1 Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: - CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776...

Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: Update to version 4.4.5. CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:3889-1 Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: - CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776...