CVE-2026-102488

Octopus Server is vulnerable to an incorrect authorization issue (CWE-863) caused by the software incorrectly evaluating multiple scoped permission assignments. This flaw allows a highly privileged user to obtain deployment permissions that exceed their actual granted authority. No specific affec...

EUVD-2026-94659

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...

CVE-2026-102488

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...

PT-2026-107741

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...

CVE-2026-106497

The Backstage open framework for building developer portals contains a vulnerability in the @backstage/plugin-catalog-backend package prior to version 3.9.1 . The root cause is an inconsistent catalog property permission evaluation . In environments where value-based catalog permission conditions...

CVE-2026-106497 Backstage: Inconsistent catalog property permission evaluation

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary...

CVE-2026-106497 Backstage: Inconsistent catalog property permission evaluation

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary...

CVE-2026-106497 Backstage: Inconsistent catalog property permission evaluation

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary...

Dotnetnuke < 10.3.3 Permission precedence flaw in module permissions (GHSA-hqgc-qj63-mx24)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - A permission evaluation flaw could allow users with page-level content permissions to access module management features despite...

PT-2026-46148

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The system fails to evaluate instructional permissions over multiple internal operation codes opcodes, which are the machine language instructions that the CPU...

OpenClaw Access Control Error Vulnerability (CNVD-2026-13408)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an access control error vulnerability. The vulnerability stems from a mismatch between rawCommand and command in the node host system.run handler, which can be exploited by an attacker to cause the...

OpenClaw Access Control Vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an access control error vulnerability. The vulnerability stems from a mismatch between rawCommand and command in the node host system.run handler, which can be exploited by an attacker to cause the...

Authorization Bypass

github.com/openfga/openfga is vulnerable to authorization bypass. The vulnerability is due to incorrect permission evaluation when usersets and type-bound public access overlap without proper tuple assignments, allowing attackers unauthorized resource access or actions...

Quarkus HTTP vulnerable to incorrect evaluation of permissions

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized...

Microsoft ASP.NET Application Folder Information Disclosure Vulnerability

Description ASP.NET is prone to an information-disclosure vulnerability. This issue is due to a failure in the applications to properly validate user-supplied input. An attacker can exploit this issue to retrieve potentially sensitive information. Information retrieved may aid in further attacks...