CVE-2026-54622

django CMS prior to 5.0.8 contains an IDOR in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py). The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths validate only the destination clipboard but never perform source-side authorization on the attacker-supplied source...

CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

MINI-3JQ8-Q8FC-HPWJ

Bulletin has no description...

tmp: path Traversal via unsanitized prefix/postfix enables directory escape

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the...

CVE-2026-19611 Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

EUVD-2026-63478

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

EUVD-2026-63403

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-63042

Apache InLong (versions 2.0.0 through before 2.4.0) contains a missing authorization flaw on its DataNode management endpoints. Any user who can authenticate to the manager can create, modify, and delete Data Node definitions , leading to high impact on integrity and availability (CVSS 8.1, HIGH)...

CVE-2026-58437

A flaw was found in Gitea. This vulnerability allows an attacker to manipulate repository visibility settings by leveraging specific Git push options. This could lead to unauthorized disclosure of repository information or unintended access control changes. Mitigation Mitigation for this issue is...

CVE-2026-56654

A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected...

Microsoft Exchange Online Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...

Azure Arc Elevation of Privilege Vulnerability

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

Azure Stack HCI Information Disclosure Vulnerability

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network...

Azure Logic Apps Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

Microsoft Entra ID Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

Azure Data Factory Information Disclosure Vulnerability

Server-side request forgery ssrf in Azure Data Factory allows an unauthorized attacker to disclose information over a network...

Azure SQL Database Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

Azure Data Factory Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-64967

ATutor's error log viewer contains a path traversal flaw allowing an admin to read arbitrary files outside the logs directory. Version 2.2.4 is confirmed vulnerable; the product is no longer supported and no fix exists, so migration to a maintained alternative is the only remediation. Exploitatio...