CVE-2026-123037

A flaw was found in the ansible-core user module. When generatesshkey is enabled, User.sshkeygen guards the key files against symlinks but checks the /.ssh directory only with os.path.exists. An unprivileged user on a managed node who replaces their /.ssh with a symlink to an existing root-writab...

CVE-2026-123037

A flaw exists in the ansible-core user module where the User.ssh_key_gen() function improperly handles symlinks when generate_ssh_key is enabled. While it guards individual key files, it only verifies the ~/.ssh directory using os.path.exists(). An unprivileged user on a managed node can replace ...

EUVD-2026-117890

A flaw was found in the ansible-core user module. When generatesshkey is enabled, User.sshkeygen guards the key files against symlinks but checks the /.ssh directory only with os.path.exists. An unprivileged user on a managed node who replaces their /.ssh with a symlink to an existing root-writab...

CVE-2026-123037 Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

A flaw was found in the ansible-core user module. When generatesshkey is enabled, User.sshkeygen guards the key files against symlinks but checks the /.ssh directory only with os.path.exists. An unprivileged user on a managed node who replaces their /.ssh with a symlink to an existing root-writab...

CVE-2026-123037

A flaw was found in the ansible-core user module. When generatesshkey is enabled, User.sshkeygen guards the key files against symlinks but checks the /.ssh directory only with os.path.exists. An unprivileged user on a managed node who replaces their /.ssh with a symlink to an existing root-writab...

UBUNTU-CVE-2026-123037

A flaw was found in the ansible-core user module. When generatesshkey is enabled, User.sshkeygen guards the key files against symlinks but checks the /.ssh directory only with os.path.exists. An unprivileged user on a managed node who replaces their /.ssh with a symlink to an existing root-writab...

CVE-2026-121514

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

EUVD-2026-116371

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

CVE-2026-121514

A weakness exists in EasySoft ZenTao PMS (up to version 22.6) within the User Module component. Specifically, the function userModel::checkGroupChange in the file module/user/model.php is susceptible to manipulation of the argument group, leading to improper privilege management . This vulnerabil...

CVE-2026-121514 EasySoft ZenTao PMS User model.php checkGroupChange privileges management

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

CVE-2024-35469

CVE-2024-35469 Submitter: Kha Do Human Resource Management System 1.0 Vulnerability SQL injection Description SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the password parameters. Affected...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible. The ansible-core user module allows an unprivileged user to silently create or replace the contents of any file on any system path, and to take ownership of that file when a privileged user executes the user module against the unprivileged user’s home directory. ...

Linux kernel DoS

The vulnerability in the buildreport function within the net/xfrm/xfrmuser.c module of the Linux kernel is related to the use of an uninitialized resource. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

CVE-2026-15675 code-projects Online Job Portal EditUser.php sql injection

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...

CVE-2026-8800

Incorrect Authorization vulnerability in Progress MOVEit Transfer Audit User module. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...

EUVD-2026-42384

Incorrect Authorization vulnerability in Progress MOVEit Transfer Audit User module. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...

CVE-2026-8800

Incorrect Authorization vulnerability in Progress MOVEit Transfer Audit User module. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...

PT-2026-56573

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 Description An incorrect authorization issue exists within the Audit User module, which may allow unauthorized access or actions. Recommendations...

CVE-2026-8800: Incorrect Authorization

Incorrect Authorization vulnerability in Progress MOVEit Transfer Audit User module. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...

PYSEC-2026-1121 ansible-core Incorrect Authorization vulnerability

A flaw was found in Ansible. The ansible-core user module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the user module against the unprivileged user's home directory. If the...