MiracleLinux 7 : 389-ds-base-1.3.5.10-20.el7 (AXSA:2017-1608:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1608:03 advisory. 389 Directory Server is an LDAPv3 compliant server. The base package includes the LDAP server and command line utilities for server administration. Security...

Pepr security vulnerabilities

Pepr is a middleware open source by Defense Unicorns. Versions of Pepr prior to 1.0.5 contained security vulnerabilities. These vulnerabilities stemmed from the default use of RBAC configuration for cluster administrators, without enforcing the principle of least privilege...

GHSA-W54X-R83C-X79Q Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode

Severity: LOW Target: /workspace/pepr/src/lib/assets/rbac.ts Endpoint: Kubernetes RBAC configuration Method: Deployment Response / Rationale Pepr defaults to rbacMode: "admin" because the initial experience is designed to be frictionless for new users. This mode ensures that users can deploy and...

Incorrect Default Permissions

Overview pepr is a Kubernetes application engine Affected versions of this package are vulnerable to Incorrect Default Permissions due to the default configuration of rbacMode being set to "admin" in the RBAC setup process. An attacker can gain broader privileges than necessary by deploying a...

EUVD-2026-2732

Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode...

CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises fro...

CVE-2026-0713

The Red Hat/CIRCL/EUVD/PTSecurity entries confirm a security issue in Grafana’s API at /apis/dashboard.grafana.app/* affecting all API versions (v0alpha1, v1alpha1, v2alpha1). Root cause: authenticated users can bypass dashboard and folder permissions, allowing Viewer role to access all dashboard...

PT-2026-3025

Name of the Vulnerable Software and Affected Versions Itflow versions through 25.06 Description An SQL injection issue exists in Itflow due to insufficient sanitization of integer parameters. Specifically, the "role id" parameter is vulnerable when editing a profile. An attacker with administrati...

CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises fro...

CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises fro...

Itflow security vulnerabilities

ITFlow is an open-source IT documentation, ticket management, and billing ERP software developed by ITFlow. Versions of Itflow 25.06 and earlier contain security vulnerabilities. These vulnerabilities stem from insufficient cleaning of the integer parameter roleid, which may lead to SQL injection...

CVE-2025-67081

Itflow is affected by CVE-2025-67081 through version 25.06. The issue is an SQL injection in the role_id parameter used when editing a profile, exploitable by an admin account via blind SQL injection to extract arbitrary data. The root cause is insufficient sanitization of an integer parameter. M...

PT-2026-3303

Name of the Vulnerable Software and Affected Versions Pepr versions prior to 1.0.5 Description Pepr, a type-safe K8s middleware, defaults to a cluster-admin RBAC configuration and does not enforce least-privilege guidance for module authors in versions prior to 1.0.5. This default behavior is...

CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises fro...

DRUPAL-CONTRIB-2026-002

This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the "administer permissions" permission. The module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. A user...

CVE-2025-14001

The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with...

PT-2026-2980

Name of the Vulnerable Software and Affected Versions Drupal AT Internet Piano Analytics versions 0.0.0 through 1.0.0 Drupal AT Internet Piano Analytics versions 2.0.0 through 2.3.0 Description The AT Internet Piano Analytics module for Drupal contains a Cross-Site Scripting XSS issue. The module...

Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002

This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the "administer permissions" permission. The module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. A user...

PT-2026-2979

Name of the Vulnerable Software and Affected Versions Drupal Role Delegation versions 1.3.0 through 1.4.9 Description A privilege escalation issue exists in the Role Delegation module. The module allows site administrators to grant specific roles the authority to assign selected roles to users,...

PT-2026-2968

This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the "administer permissions" permission. The module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. A user...