CVE-2026-108951 LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

CVE-2026-108951

LavaLite CMS versions through 10.1.2 are vulnerable to an authorization bypass in the user update API. The flaw stems from an improper check within the AbstractRequest isWorkflow() function. This allows authenticated low-privileged users to send a PATCH request to the user update route, using a t...

CVE-2026-108951 LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

EUVD-2026-97358

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

CLSA-2026-1791807020 TuxCare security update for 9 packages (28 CVEs)

TuxCare rebuilt 9 packages to address 28 CVEs. Fixed in 15.1.2-tuxcare.2...

CLSA-2026-1791806891 TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 6.2.6-tuxcare.2...

CLSA-2026-1791806459 TuxCare security update for nodemailer (11 CVEs)

TuxCare rebuilt nodemailer to address 11 CVEs. Fixed in 9.0.6-tuxcare.1...

CLSA-2026-1791806453 TuxCare security update for nanoid (2 CVEs)

TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.8-tuxcare.1...

CLSA-2026-1791806331 TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3...

CVE-2026-105411 Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance...

CLSA-2026-1791795546 TuxCare security update for vite (2 CVEs)

TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.0.12-tuxcare.4...

Important: Red Hat Security Advisory: gd security update

An update for gd is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

CVE-2026-109186: Improperly Controlled Modification of Dynamically-Determined Object Attributes

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...

CVE-2026-109178: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP...

Rocky Linux 8.6 [CIQ] Security Update: chkrootkit (ciqsa-2026_1594)

The Rocky Linux 8.6 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20261594 advisory. This advisory aggregates security fixes for the chkrootkit SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2014-0476. Tenable has extracted the preceding description...

CVE-2026-103521: Unrestricted Upload of File with Dangerous Type

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

Dell System Update < 2.3.0.0 Multiple Vulnerabilities (DSA-2026-324)

According to its self-reported version, the Dell System Update DSU installation on the remote host is prior to 2.3.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2026-324 advisory. - Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitati...

Rocky Linux 8.6 [CIQ] Security Update: libksba / libksba-devel (ciqsa-2026_1603)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261603 advisory. This advisory aggregates security fixes for the libksba SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2022-3515. Tenable has extracted the preceding description...

PT-2026-110534

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition versions 17.0 through 17.5 Description An authorization bypass occurs through a user-controlled key, allowing an attacker who possesses tracker administration rights on a single tracker to update or delete fields acro...

PT-2026-110548

Name of the Vulnerable Software and Affected Versions LavaLite CMS versions prior to 10.1.3 Description An authorization bypass allows authenticated low-privileged users to modify other users' accounts, including those of administrators. This is achieved by abusing the isWorkflow check within the...