CVE-2026-72551 Apioo Fusio - Remote Code Execution

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...

CVE-2026-72551

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...

CVE-2026-72551

CVE-2026-72551 affects Apioo Fusio 8.8.3. A remote code execution flaw arises from a PHP-Sandbox allow-list bypass that permits functions transitively invoking system(), enabling an authenticated Developer-role user to escape the sandbox and run arbitrary OS commands on the server, potentially ac...

EUVD-2026-56021

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...

CVE-2026-72551 Apioo Fusio - Remote Code Execution

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...

CVE-2026-15556

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...

PT-2026-70234

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

PT-2026-70140

Name of the Vulnerable Software and Affected Versions Ghost Foundation Ghost versions 5.x Description An issue with broken access control allows authenticated users with the Author role to delete posts belonging to other users. This occurs because the permissible function in the post model lacks ...

PT-2026-70843

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...

PT-2026-70142

Name of the Vulnerable Software and Affected Versions Apioo Fusio version 8.8.3 Description An authenticated user with the consumer role can trigger server-side request forgery by registering a webhook URL that points to an internal host. The webhook registration endpoint validates URL syntax usi...

PT-2026-70087

Name of the Vulnerable Software and Affected Versions Picketlink Federation SAML affected versions not specified Description The unsolicited response handler accepts forged assertions without verification or validation. This allows an unauthenticated attacker to authenticate as any principal in a...

PT-2026-70126

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...

CVE-2026-72910

CVE-2026-72910 affects ERPNext prior to versions 15.112.0 and 16.22.0. The issue arises because the functions merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center (across ERPNext code paths: erpnext/accounts/doctype/account/account.py, erpnext/account...

CVE-2026-18608

The vulnerability CVE-2026-18608 affects the Data Science Pipelines Operator (DSPO). Its ClusterRole grants excessive privileges beyond what is needed, including pods/exec and cluster-wide role/binding control. If a DSPO pod is compromised, an attacker could leverage these permissions to achieve ...

CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...

CVE-2026-72868

Dokploy prior to v0.29.13 is vulnerable: destination.testConnection fields are interpolated into an rclone ls command executed via child_process.exec, enabling a low-privileged member with destination:create permission to craft arguments and execute arbitrary commands in the Dokploy container, wh...

CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...

CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...

CVE-2026-59233

CVE-2026-59233 affects Roskus Prospero Flow CRM prior to 5.2.1 in the permission management component. The permission save endpoint performs no authorization check, allowing any authenticated user to grant any role the full set of application permissions via a crafted POST request, enabling privi...

CVE-2026-19278 Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...