EUVD-2026-69800

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacke...

EUVD-2026-69790

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations...

CVE-2026-73778

A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providi...

CVE-2026-73762

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy...

CVE-2026-73778

CVE-2026-73778 affects the Credential Manager component of HPE Aruba Networking ArubaOS-CX (AOS-CX) . In its factory-default or post-ZTP state , before an administrator configures credentials, an unauthenticated remote attacker can provide a predictable factory-default password to gain full admin...

CVE-2026-73762

CVE-2026-73762 affects the API endpoint of HPE ArubaOS-CX (AOS-CX) , where a remote actor with high privileges can circumvent configured access controls, potentially gaining unauthorized access to management functionality that should be restricted. The vulnerability is rated CVSS 3.1 6.6 (MEDIUM)...

CVE-2026-73762 Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy...

EUVD-2026-69626

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

EUVD-2026-69441

A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to access data beyond what is authorized by the user's existing privilege level, potentially leading to further...

CVE-2026-13348

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled...

CVE-2026-13348

Schneider Electric PowerChute Serial Shutdown versions prior to 1.6 are affected by a CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability. When redirect handling is disabled , an attacker can perform an arbitrary number of authentication attempts over the network to g...

CVE-2026-13348

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled...

CVE-2026-40204

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass Access Control List ACL restrictions through the ldamailboxautocreate feature. This could potentially grant unauthorized access to mailboxes or other restricted resources. Mitigation Mitigation for this issue is either n...

CVE-2026-82747

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an accesstype :runtime read policy a check evaluated per record rather than compiled to a filter, Ash.Policy.Authorizer decides each record in checkresult/1...

PT-2026-84480

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A flaw in the API endpoint allows a remote actor to bypass established access controls. This may result in unauthorized access to management functionality that is intended to be restricted by...

MiracleLinux 9 : grafana-10.2.6-23.el9_8.2 (AXSA:2026-1719:25)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1719:25 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6...

PT-2026-84418

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A sensitive information disclosure issue exists in the API of HPE Networking Fabric Composer. An authenticated user with low privilege operator permissions can access...

CVE-2026-82394

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in...