CVE-2026-68752 Project Resource Managers may escalate privileges in JFrog Artifactory

A Project Resource Manager may gain broader administrative privileges under specific conditions...

EUVD-2026-57240

A Project Resource Manager may gain broader administrative privileges under specific conditions...

CVE-2026-73294: Improper Neutralization of Special Elements used in an OS Command

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

PT-2026-71284

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An authorization bypass allows an authenticated attacker to circumvent target project restrictions during instance migration. The issue occurs because LXD accepts configuration overrides without...

CVE-2026-47717: Insertion of Sensitive Information Into Sent Data

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue...

CVE-2026-68752: Improper Privilege Management

A Project Resource Manager may gain broader administrative privileges under specific conditions...

PT-2026-71283

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An authorization bypass allows an authenticated attacker to circumvent project-level container isolation restrictions. The issue occurs when a project is configured to enforce restricted containe...

CVE-2026-63295: Incorrect Authorization

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges such as enforcing restricted.containers.privilege=isolated, LXD fails to enforce the...

Debian dla-4735 : neutron-api - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4735 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4735-1 [email protected] https://www.debian.org/lts/security/...

GitLab 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-16494)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify proje...

CVE-2026-73293: Improper Privilege Management

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

PT-2026-71216

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user can modify project settings that are normally restricted to roles with higher privileges. This occurs due to...

CVE-2026-16494: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a proje...

CVE-2026-63300: Missing Authorization

An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...

CVE-2026-62420: Incorrect Authorization

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...

PT-2026-71224

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An authorization bypass allows an authenticated attacker to circumvent security restrictions of a target project during cross-project instance migrations. By using the 'POST /1.0/instances/name'...

PT-2026-71107

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description A Project Resource Manager may gain broader administrative privileges under specific conditions, leading to privilege escalation. Recommendations At the moment, there is no...

CVE-2026-6821: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a...

PT-2026-71227

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.0 through 19.0.5 GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user can bypass IP-based access restrictions to read limited merge request...

PT-2026-71226

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An improper validation issue in the instancePostMigration function within lxd/instance post.go allows an authenticated attacker with can create instances permissions on a restricted project to...