Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

CVE-2026-67548 taOS: Non-Admin Users Can Access System Settings and Update Actions

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos taOS registers all system settings routes under a single APIRouter instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose isadmin flag is explicitly...

CVE-2026-67548 taOS: Non-Admin Users Can Access System Settings and Update Actions

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos taOS registers all system settings routes under a single APIRouter instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose isadmin flag is explicitly...

CVE-2026-67548

The self-hosted AI agent OS taOS (tinyagentos) is vulnerable to Missing Authorization (CWE-862) in versions prior to 1.0.0-beta.25 . The software incorrectly registers all system settings routes under an APIRouter() instance that lacks an admin authorization dependency. This allows any authentica...

CVE-2026-124623

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is...

CVE-2026-124623

A security flaw exists in PipraPay 3.0.0 within the ZIP Archive Handler component. Specifically, the system-settings-import function located at /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import is vulnerable to manipulation. This flaw allows for unrestricted upload and can be ...

CVE-2026-124623 PipraPay ZIP Archive system-settings-import unrestricted upload

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is...

CVE-2026-124623 PipraPay ZIP Archive system-settings-import unrestricted upload

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is...

CVE-2026-124623 PipraPay ZIP Archive system-settings-import unrestricted upload

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is...

EUVD-2026-120049

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is...

PT-2026-140413

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is...

CVE-2026-124623: n/a PipraPay: A security flaw has been discovered in PipraPay 3.0.0

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is...

[SECURITY] Fedora 45 Update: sddm-kcm-6.8.1-1.fc45

This is a System Settings configuration module for configuring the SDDM Display Manager...

[SECURITY] Fedora 45 Update: plymouth-kcm-6.8.1-1.fc45

This is a System Settings configuration module for configuring the plymouth splash screen...

[SECURITY] Fedora 45 Update: kde-gtk-config-6.8.1-1.fc45

This is a System Settings configuration module for configuring the appearance of GTK apps in KDE...

[SECURITY] Fedora 45 Update: colord-kde-26.08.2-1.fc45

KDE support for colord including KDE Daemon module and System Settings module...

PT-2026-130607

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT SYSTEM SETTINGS permission can upload an HTML fi...

PT-2026-130614

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT SYSTEM SETTINGS permission can set a notice containing an arbitrary script PUT /api/preloginnotice, resulting in stored cross-site...

Apple MacOS: CVE-2026-112512: OS X update for System Settings

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to bypass Gatekeeper checks...

Apple MacOS: CVE-2026-112556: OS X update for System Settings

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context...