CVE-2026-65931

LimeSurvey Community Edition 7.0.5 has an improper authorization flaw in the survey menu entry creation endpoint (POST /index.php/admin/menuentries/sa/create ). An authenticated user holding only the settings:read permission can invoke this endpoint and create new survey menu entries without the ...

CVE-2026-81668

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

CVE-2026-81668: Authorization Bypass Through User-Controlled Key

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

CVE-2026-76371: Incorrect Permission Assignment for Critical Resource

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

PT-2026-79948

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

PT-2026-79889

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

CVE-2026-66154

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 Build 9510.1044 and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes...

CVE-2026-66154

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 Build 9510.1044 and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes...

CVE-2026-66154

SonicWall GMS application versions 9.5.1 (Build 9510.1044) and earlier are vulnerable to CVE-2026-66154 , which involves insufficient certificate validation in a privileged communication workflow. Under controlled network conditions, a successful Man-in-the-Middle (MitM) attack could permit an at...

CVE-2026-66154

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 Build 9510.1044 and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes...

PT-2026-70910

Name of the Vulnerable Software and Affected Versions GMS application versions prior to 9.5.1 Build 9510.1044 Description Insufficient certificate validation exists within a privileged communication workflow. This flaw allows an attacker to perform a Man-in-the-Middle MitM attack—a technique wher...

CVE-2026-66154: Improper Certificate Validation

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 Build 9510.1044 and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes...

EUVD-2026-53421

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...

CVE-2026-58337

A flaw was found in Moodle. The user homepage preference setting lacked a necessary token, making it vulnerable to a Cross-Site Request Forgery CSRF attack. A remote attacker could exploit this to trick a user into performing unwanted actions on the Moodle platform without their knowledge,...

CVE-2026-58341

A flaw was found in Moodle. The actions to enable and disable group messaging did not include the necessary token to prevent a Cross-Site Request Forgery CSRF risk. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, potentially leading to...

CVE-2026-18028 Missing authorization check in event quick setup view

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

CVE-2026-18028

CVE-2026-18028 describes a missing authorization check in the "+quick setup+" view presented after creating an event. The flaw allows an attacker to send well-timed requests to perform privileged actions on events the user should not access, including creating products, quotas, configuring bank t...

PT-2026-65632

Name of the Vulnerable Software and Affected Versions samba affected versions not specified Description A flaw exists where a TSIG Transaction Signature packet containing crafted name compression can cause the DNS server to crash. This occurs during the processing of DNS packets that use specific...

EUVD-2026-46489

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Security Framework. The supported version that is affected is 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

📄 xxl-job Cross Site Request Forgery

xxl-job versions prior to 3.4.0 suffer from a cross site request forgery vulnerability. Description Summary A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The...