CVE-2026-84653

A flaw was found in Jenkins. An attacker with Overall/Manage permission can exploit incorrect permission checks in the Appearance configuration page. This allows them to modify configuration options they should not have access to, potentially leading to unauthorized changes within the Jenkins...

PT-2026-96131

Name of the Vulnerable Software and Affected Versions GoCD versions 18.3.0 through 26.0.0 Description Stored cross-site scripting occurs when the server generates unescaped tracking-tool links from commit comments. This happens when a project uses a lenient Tracking Tool regular expression with a...

CVE-2026-52823

Kimai , an open-source time tracking application, contains an authenticated CSRF vulnerability in its TimesheetController (src/API/TimesheetController.php). Prior to version 2.58.0 , the stop and restart operations were exposed as GET requests without a request-forgery defense, while reusing the ...

CVE-2026-86494

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86494

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86494

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86494

In JetBrains YouTrack versions prior to 2026.2.18634 , cloning a whiteboard allowed an attacker with low privileges to make unauthorized changes to links on issues they could not otherwise access. The vulnerability is rated CVSS 7.7 (High) with changed scope and high integrity impact , requiring ...

CVE-2026-73706 Authentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state of certain settings of a vulnerable system. Successful exploitation could allow an attacker to gain insight into internal servic...

CVE-2026-73706

CVE-2026-73706 is an Authentication Bypass vulnerability in the API of HPE Networking Fabric Composer . An unauthenticated remote attacker can obtain limited system information and change the state of certain settings on a vulnerable system. Successful exploitation may expose insight into interna...

CVE-2026-73706 Authentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state of certain settings of a vulnerable system. Successful exploitation could allow an attacker to gain insight into internal servic...

CVE-2026-73735: Files or Directories Accessible to External Parties

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is...

CVE-2026-65931

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

CVE-2026-65931

LimeSurvey Community Edition 7.0.5 has an improper authorization flaw in the survey menu entry creation endpoint (POST /index.php/admin/menuentries/sa/create ). An authenticated user holding only the settings:read permission can invoke this endpoint and create new survey menu entries without the ...

CVE-2026-81668: Authorization Bypass Through User-Controlled Key

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

CVE-2026-76371: Incorrect Permission Assignment for Critical Resource

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

PT-2026-79948

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

CVE-2026-66154

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 Build 9510.1044 and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes...

CVE-2026-66154

SonicWall GMS application versions 9.5.1 (Build 9510.1044) and earlier are vulnerable to CVE-2026-66154 , which involves insufficient certificate validation in a privileged communication workflow. Under controlled network conditions, a successful Man-in-the-Middle (MitM) attack could permit an at...

CVE-2026-66154

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 Build 9510.1044 and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes...

CVE-2026-66154

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 Build 9510.1044 and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes...