CVE-2026-18381

The CVE-2026-18381 affects the koku-metrics-operator used with Red Hat OpenShift. A flaw in the CostManagementMetricsConfig custom resource lets an authorized user edit the CR to specify an arbitrary upload URL. The operator then attaches its Kubernetes service-account bearer token to queries sen...

Apache Camel JIRA Java Framework Unauthorized Access

The vulnerability of the Apache Camel JIRA Java framework involves bypassing authentication using a user-controlled key. Exploiting this vulnerability can allow an intruder to gain unauthorized access to read, modify, add, and delete objects in the target JIRA system...

CVE-2026-62431

A flaw was found in Xen. The logic responsible for handling periodic Viridian STIMERs performs a division operation using a value that can be controlled by a user. If a malicious user sets this divisor value to zero, it can lead to a division-by-zero error, resulting in a DE fault and causing a...

CVE-2026-62431

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

ALPINE-CVE-2026-62431

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

CVE-2026-62431

The Xen hypervisor is vulnerable to a division by zero error in the logic handling periodic Viridian STIMERs . An attacker can provide a user-controlled divisor value set to zero, which triggers a #DE fault . This vulnerability has been addressed in several distributions, including SUSE (via vers...

CVE-2026-62431

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

CVE-2026-62431 Viridian STIMER division by zero

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

EUVD-2026-49784

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

BIT-KIBANA-2026-63259 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

BIT-KIBANA-2026-56147 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

BIT-ELK-2026-63259 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

PT-2026-65473

Name of the Vulnerable Software and Affected Versions Viridian affected versions not specified Description The logic used to handle periodic Viridian STIMERs performs a division operation using a user-controlled divisor value that is not checked. If this value is set to zero, it triggers a DE...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the tickets.getMilestone process. An attacker can retrieve sensitive milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs through the...

CVE-2026-59546: Authorization Bypass Through User-Controlled Key

Subscriber Broken Authentication in Hide My WP Ghost = 7.0.06 versions...

IBM DB2 Remote Code Execution (7279479) (Unix)

According to its self-reported version number, IBM Db2 is affected by a remote code execution vulnerability: - IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CVE-2026-9762 Note that Nessus has not tested for this issue but has...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through improper validation of ownership in the editRecord process. An attacker can modify or overwrite DNS records in zones they do not own by manipulating the rid and zid parameters in ...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SASL PLAIN authentication process. An attacker can gain unauthorized access to arbitrary directory user accounts by supplying an authorization identity authzid that resolves to a...

Authorization Bypass Through User-Controlled Key

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the POST /api/v2/email process. An attacker can gain unauthorized access to another user's account by supplying a victim's accountId and an...

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...