739 matches found
CVE-2026-68493
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...
CVE-2026-68493
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...
EUVD-2026-82623
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...
CVE-2026-68493
CVE-2026-68493 describes a vulnerability where, after guessing a 62¹⁵ complex unique identifier , a malicious logged-in user could retrieve a list of memberships for a circle they are not a member of. The CVSS 3.0 base score is 3.1 (Low) , reflecting high attack complexity and low confidentiality...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Firmware: armffa: Fixed FFA device names for logical partitions. Each physical partition can provide multiple services, each with a unique UUID. Each such service can be represented as a logical partition with a unique combinatio...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: rtnetlink: Allocate sufficient vfinfo size for VF GUIDs when supported. Commit 30aad41721e0 "net/core: Add support for getting VF GUIDs" added support for obtaining VF port and node GUIDs in netlink’s ifinfo messages. However,...
EUVD-2026-54171
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...
CLSA-2026-1782089809 TuxCare security update for uuid (2 CVEs)
TuxCare rebuilt uuid to address 2 CVEs. Fixed in 3.4.0-tuxcare.2...
CLSA-2026-1779065185 TuxCare security update for uuid (1 CVE)
TuxCare rebuilt uuid to address 1 CVE. Fixed in 8.3.2-tuxcare.1...
CLSA-2026-1778805966 TuxCare security update for uuid (2 CVEs)
TuxCare rebuilt uuid to address 2 CVEs. Fixed in 11.0.5-tuxcare.1...
GHSA-V5MV-P594-2X33
creationtimestamp| type| source ---|---|--- 2026-08-04 01:31:43+00:00| seen| https://gist.github.com/alon710/aa0d8e0a2033bd155210db761c2f4b38...
PT-2026-67412
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups roles.php...
EUVD-2026-52008
The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...
EUVD-2026-50214
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...
PT-2026-65741
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the client policy enforcement mechanism where the system verifies group membership using names rather than unique identifiers. An attacker possessing client management...
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the /upload/file endpoint accepting any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid claims without verifying the token's intended purpose. An attacker can...
Improper Restriction of Security Token Assignment
Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the /upload/file endpoint accepting any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid claims without verifying th...
GHSA-8R6W-3QQ5-4P4R Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...