CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-72908

ERPNext contains an SQL injection in get_tax_template (erpnext/accounts/doctype/tax_rule/tax_rule.py) exploitable by an authenticated low-privilege user through request-influenced posting_date and args values. The issue affects pre-15.109.0 and pre-16.20.0 releases and can lead to extraction of s...

CVE-2026-72906 ERPNext: Unauthorised triggering of automated emails due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the sendautoemail function in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated...

CVE-2026-72906 ERPNext: Unauthorised triggering of automated emails due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the sendautoemail function in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated...

CVE-2026-72906

CVE-2026-72906 details (NORMAL): ERPNext (open-source ERP) contains a permission validation issue in the send_auto_email function within erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py. The root cause is the absence of a Process Statement Of Accounts permis...

CVE-2026-18620

CVE-2026-18620 affects Data Science Pipelines. A restricted user/tenant can abuse an improper authorization in the setDefaultServiceAccount function by supplying a more privileged ServiceAccount in a CreateRun request, bypassing checks and enabling containers to run with elevated privileges. This...

CVE-2026-18620

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

CVE-2026-18620 Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

CVE-2026-18620 Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

EUVD-2026-55826

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

CVE-2026-18620

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-63622

CVE-2026-63622 : Affected software is libvirt. The flaw is a symlink-following vulnerability in the virFileChownFiles() function that allows a local attacker running as the confined swtpm user to plant a symbolic link in the swtpm state directory, tricking the root‑level libvirt daemon into chang...

CVE-2026-63622 Libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

EUVD-2026-55823

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-63622 Libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

EUVD-2026-55822

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18982 Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...