54604 matches found
CVE-2026-68561
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
EUVD-2026-62703
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
CVE-2026-68561
Wekan (open-source kanban built with Meteor) prior to 9.89 has a privilege escalation flaw in server/permissions/boards.js. The canUpdateBoardSort check authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR semantics and applies the complete mo...
EUVD-2026-62597
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...
CVE-2026-58564
Dell Command Update DCU, versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...
EUVD-2026-62529
Dell Command Update DCU, versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...
CVE-2026-58564
Dell Command Update (DCU) versions prior to 5.7.1 ship with overly permissive default file permissions. A low-privileged local attacker can leverage this to access the filesystem, achieving high confidentiality, integrity, and availability impact (CVSS 7.8). Remediation is to upgrade DCU to versi...
CVE-2026-58564
Dell Command Update DCU, versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...
GHSA-V5RC-CPWC-CFPR
creationtimestamp| type| source ---|---|--- 2026-08-19 07:31:59+00:00| seen| https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad...
PT-2026-78480
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0 Description A path traversal issue exists in the EDI archive restore function. The archrestore sel POST parameter is processed by the archive restore handler without proper sanitization for path traversal...
PT-2026-78815
Name of the Vulnerable Software and Affected Versions Splunk Enterprise Security versions prior to 8.6.1 Description A user with the ess analyst role can modify User and Entity Behavior Analytics UEBA search macros. Because these macros are used by scheduled searches that execute with administrat...
PT-2026-78472
Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description Incorrect default permissions allow a low privileged attacker with local access to potentially gain filesystem access. Recommendations Update Dell Command Update DCU to version 5.7.1 ...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permis...
UBUNTU-CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permis...
CVE-2026-53456
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...
CVE-2026-66780
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
EUVD-2026-61078
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
CVE-2026-66780
The CVE-2026-66780 CVELIST title reveals the root cause: the flat broker trust model grants every spoke cluster full CRUD on all endpoints, secrets, and EndpointSlices in the broker namespace. This excessive RBAC lets a compromised cluster overwrite other clusters' endpoint data, redirecting inte...
CVE-2026-75924
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...
CVE-2026-66780
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...