CVE-2026-107334

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS . Affected versions include those prior to 9.2.2d and versions 10.0.0 through 10.0.0a1 . The root cause allows an authenticated user or local process capa...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

EUVD-2026-94742

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

CVE-2026-94575

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-94575

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

EUVD-2026-94682

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-94575

A logic vulnerability exists in the Brocade Fabric OS web management framework in versions before 10.0.1 . This flaw allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation can lower the ...

CVE-2026-94575

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

PT-2026-107799

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for t...

CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC 권한 부여 정책 우회 :path 슬래시 누락으로 인한 인증 우회 설명 google.golang.org/grpc의 authz 패키지는 SDK 수준 RBAC 권한 부여를 구현하며, :path 유사 헤더에 대해 거부 및 허용 규칙을 매칭합니다. HTTP/2 서버 전송 계층은 클라이언트로부터 원시 :path 값을 /로 시작하는지 검증 없이 저장합니다. 라우팅 계층handleStream은 디스패치 전에 경로를 정규화하지만, RBAC 엔진은 grpc.Methodctx를 통해 컨텍스트에서...

Privilege Escalation / Access Control Bypass in Brocade Fabric OS Web Management Framework (CVE-2026-94575)

: A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for...

Privilege escalation vulnerability exists in the internal Command-Line Interface of Fabric OS (CVE-2026-94577)

: A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypas...

CVE-2026-92142

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

EUVD-2026-88664

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

CVE-2026-92142: Missing Authorization

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

Partial String Comparison

Overview @grpc/grpc-js-xds is a Plugin for @grpc/grpc-js. Adds the xds:// URL scheme and associated features. Affected versions of this package are vulnerable to Partial String Comparison via the PathExactValueMatcher.apply method in matcher.ts, where the case-insensitive exact path match...

CVE-2026-100703

Kyverno versions 1.16.0 through 1.19.0 are vulnerable to a cross-namespace data access issue due to the improper registration of the globalcontext.Lib CEL library . Unlike other sibling libraries, this component is not confined to the policy's namespace. A tenant with permissions to create a name...