CVE-2026-108951

LavaLite CMS versions through 10.1.2 are vulnerable to an authorization bypass in the user update API. The flaw stems from an improper check within the AbstractRequest isWorkflow() function. This allows authenticated low-privileged users to send a PATCH request to the user update route, using a t...

CVE-2026-108951 LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

EUVD-2026-97358

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

CLSA-2026-1791807020 TuxCare security update for 9 packages (28 CVEs)

TuxCare rebuilt 9 packages to address 28 CVEs. Fixed in 15.1.2-tuxcare.2...

CLSA-2026-1791806891 TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 6.2.6-tuxcare.2...

CLSA-2026-1791806459 TuxCare security update for nodemailer (11 CVEs)

TuxCare rebuilt nodemailer to address 11 CVEs. Fixed in 9.0.6-tuxcare.1...

CLSA-2026-1791806453 TuxCare security update for nanoid (2 CVEs)

TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.8-tuxcare.1...

CLSA-2026-1791806331 TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3...

CVE-2026-105411 Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance...

CLSA-2026-1791795546 TuxCare security update for vite (2 CVEs)

TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.0.12-tuxcare.4...

Important: Red Hat Security Advisory: gd security update

An update for gd is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

CVE-2026-109186: Improperly Controlled Modification of Dynamically-Determined Object Attributes

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...

Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution RCE, server-side template injection SSTI, stored...

Rocky Linux 9.6 [CIQ] Security Update: WALinuxAgent / WALinuxAgent-cvm / WALinuxAgent-udev (ciqsa-2026_1629)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261629 advisory. This advisory aggregates security fixes for the WALinuxAgent SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2019-0804. Tenable has extracted the preceding descripti...

PT-2026-110548

Name of the Vulnerable Software and Affected Versions LavaLite CMS versions prior to 10.1.3 Description An authorization bypass allows authenticated low-privileged users to modify other users' accounts, including those of administrators. This is achieved by abusing the isWorkflow check within the...

CVE-2026-109178: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP...

gd security update

2.3.3-20.1 - Fix LZW decompression in GIF handling CVE-2026-9672 Resolves: RHEL-259570...

Rocky Linux 8.6 [CIQ] Security Update: libksba / libksba-devel (ciqsa-2026_1603)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261603 advisory. This advisory aggregates security fixes for the libksba SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2022-3515. Tenable has extracted the preceding description...

Dell System Update < 2.3.0.0 Multiple Vulnerabilities (DSA-2026-324)

According to its self-reported version, the Dell System Update DSU installation on the remote host is prior to 2.3.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2026-324 advisory. - Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitati...

PT-2026-110601

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description The document update endpoint fails to validate file types, unlike the document upload endpoint which correctly blocks executable files. An attacker with administrative permissions can exploit this to upload...