PT-2026-66597

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.7 Description TenantResource RawItems and Generators in internal/controllers/resources/collect.go, specifically within the handleRawItem and handleGeneratorItem functions, fail to apply the...

CVE-2026-16543 Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

Linux Distros Unpatched Vulnerability : CVE-2026-66138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Age...

Budibase: Privilege escalation via public role assignment API missing app-level authorization

Summary Budibase 3.39.19 commit 03fbabae4 is affected by a privilege-escalation / missing-authorization flaw in the public role-assignment API. An app-scoped builder a user who builds only specific apps — user.builder.apps = appA, not a global builder or admin can grant themselves builder access ...

CVE-2026-66138

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...

CVE-2026-66138

OpenStack Ironic Python Agent (up to 11.6.0) is affected. A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent by supplying a malicious configuration that causes the ntp_server value to be passed to a shell. The vulnerability allows rem...

EUVD-2026-48476

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...

PT-2026-64232

Name of the Vulnerable Software and Affected Versions OpenStack Ironic Python Agent versions prior to 11.6.1 Description A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent. This occurs because the value of the ntp server variable is...

EUVD-2026-42272

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope...

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Summary A scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, and the application's own database via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 ScopedFs containme...

GHSA-FMM7-X4GX-8JHR File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Summary A scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, and the application's own database via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 ScopedFs containme...

CVE-2026-63743

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed...

CVE-2026-54497

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to renderin; if the same component, collection, or spacer component instance is reused...

CVE-2026-58410

ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-privileged users to read and modify other families’ records. An authenticated non-admin user with EditSelf access can supply another...

CVE-2026-56252

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks...

CVE-2026-56252 Capgo - Scope Isolation Failure in Webhook Test Endpoint

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks...

EUVD-2026-43225

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks...

CVE-2026-56252

Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks...

CVE-2026-56252

Capgo before 12.128.2 is affected by a scope isolation vulnerability in the POST /webhooks/test endpoint. The issue allows app-scoped API keys to invoke organization-scoped webhook operations, enabling attackers with app-scoped credentials to trigger signed outbound webhook deliveries for arbitra...