CVE-2026-108982

VeraCrypt 1.26.29 FUSE-T build on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service go-nfsv4 and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the...

CVE-2026-108982

VeraCrypt 1.26.29 FUSE-T build on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service go-nfsv4 and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the...

EUVD-2026-97161

VeraCrypt 1.26.29 FUSE-T build on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service go-nfsv4 and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the...

CVE-2026-108982

VeraCrypt 1.26.29 FUSE-T build on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service go-nfsv4 and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the...

CVE-2026-108982

The VeraCrypt 1.26.29 (FUSE-T build) on macOS contains a vulnerability where the FUSE-T auxiliary service (go-nfsv4) and its helper processes fail to terminate upon volume dismounting. This incomplete cleanup allows the auxiliary mount to continue serving the decrypted volume image (volume.dmg ) ...

CVE-2026-108982: Incomplete Cleanup

VeraCrypt 1.26.29 FUSE-T build on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service go-nfsv4 and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the...

CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-100566

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...

CVE-2026-86857

An authorization bypass vulnerability exists in the ServiceNow AI Platform . This flaw could allow an authenticated user to access data they are not entitled to, potentially leading to further unintended access. ServiceNow has remediated the issue and deployed updates to hosted instances, providi...

EUVD-2026-86393

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

CVE-2026-86857: Missing Authorization

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

CVE-2026-94217

CVE-2026-94217 is a flaw in the User-Managed Access (UMA) implementation of Keycloak , specifically in the authorization token endpoint when processing permission tickets. When two different users own resources with the same name, the system incorrectly merges permissions from both resources when...

CVE-2026-94217: Missing Authorization

A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...

EUVD-2026-78936

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

PT-2026-89744

Name of the Vulnerable Software and Affected Versions Forgejo versions prior to 16.0.4 Description Restricted API tokens can be used to gain unauthorized access to the "allow maintainer edit" feature. Recommendations Update to version 16.0.4 or later...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-47846

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRAUSER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassand...

BIT-CASSANDRA-2026-47846 Default superuser cassandra:cassandra left active when CASSANDRA_USER is customized

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRAUSER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassand...

CVE-2026-48776: Improper Limitation of a Pathname to a Restricted Directory

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource...