BIT-MONGODB-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-82377

Apache Roller version 6.1.5 is vulnerable to a missing authorization flaw in the legacy XML-RPC Blogger and MetaWeblog APIs . While the handlers authenticate the caller, they fail to verify if the caller has specific permissions for the target weblog or entry. This allows an authenticated user to...

CVE-2026-82377 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

CVE-2026-59969

A flaw was found in Apache ZooKeeper. When operating in FIPS Federal Information Processing Standards mode with specific Transport Layer Security TLS settings enabled, ZooKeeper's quorum communication fails to properly verify the hostname of peer certificates. This vulnerability allows a maliciou...

CVE-2026-84653

A flaw was found in Jenkins. An attacker with Overall/Manage permission can exploit incorrect permission checks in the Appearance configuration page. This allows them to modify configuration options they should not have access to, potentially leading to unauthorized changes within the Jenkins...

CVE-2026-84657

A flaw was found in Jenkins. The build command-line interface CLI does not properly enforce permissions when canceling a build. An attacker with Item/Build permission can exploit this by using the -s flag to cancel builds initiated by other users, leading to unauthorized disruption of ongoing...

Eclipse Jetty - Information Disclosure

Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive informatio...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK (August 2026) affect IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK security updates in August 2026. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION:...

PT-2026-99901

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

PT-2026-99985

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

PT-2026-99937

Name of the Vulnerable Software and Affected Versions @xhmikosr/decompress versions prior to 10.2.2 @xhmikosr/decompress versions prior to 11.1.4 decompress versions prior to 4.2.2 Description The default decompressinput, output API uses lexical containment checks that fail to account for the...

PT-2026-99790

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description An authenticated user can read, modify, or delete weblog content belonging to other weblogs. This occurs because the handlers for the legacy XML-RPC Blogger and MetaWeblog APIs authenticate the caller bu...

PT-2026-102332

Name of the Vulnerable Software and Affected Versions Eleveo Quality Management version 9.7.0 Description A path traversal issue exists in the Questionnaire Audio Upload component within the Scorecard.jsp file. This flaw allows a remote attacker to manipulate file paths to access unauthorized...

PT-2026-99911

Name of the Vulnerable Software and Affected Versions Dell Boot Optimized Server Storage BOSS versions prior to 2.2.13.2038 Description The SMCU on 17G BOSS-N1 controllers contains an On-Chip Debug and Test Interface with improper access control. An unauthenticated attacker with physical access t...

ipa security, bug fix, and enhancement update

4.13.4-1.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 - Add bind to ipa-server-common Requires Orabug: 36518596 4.13.4-1 - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval reachable before authorization check allows environment disclosure and denial of...

CVE-2026-80358: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80357: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-90924: Use of Default Credentials

Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117...

PT-2026-99905

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 Description The Git webhook receiver the gitjob webhook service fails to verify incoming requests when a webhook secret is not configured. This allows a remote caller with network access to the...