AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1757427057)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1757427057 advisory. - Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16,...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2026:1781274708)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781274708 advisory. - Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability...

CVE-2026-100612 Capgo SSO Provider ID Authentication Bypass via Incomplete Migration

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

CVE-2026-100612

Capgo (capgo.app) versions through 12.261.0 are vulnerable to a vertical privilege escalation and account takeover due to an incomplete access-control fix in the public.sso_providers table. The migration 20260826100000_sso_providers_block_direct_active_insert.sql fails to freeze the provider_id c...

CVE-2026-100612 Capgo SSO Provider ID Authentication Bypass via Incomplete Migration

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

EUVD-2026-87707

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

CVE-2026-100612 Capgo SSO Provider ID Authentication Bypass via Incomplete Migration

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

PT-2026-99283

Name of the Vulnerable Software and Affected Versions Capgo capgo.app versions prior to 12.261.0 Description An incomplete access-control fix in the public.sso providers table allows a user with org admin permissions and the org.update settings permission to perform vertical privilege escalation...

CVE-2026-100612: Authorization Bypass Through User-Controlled Key

Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...

CVE-2026-75458

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

CVE-2026-75458: Authorization Bypass Through User-Controlled Key

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

PT-2026-83980

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

CVE-2026-75458

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

EUVD-2026-68881

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below within the Alarms comments functionality. An authenticated customer user can manipulate API request parameters to create or modify system-generated alarm comments. This flaw allows for unauthorize...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2025-70340: Improper Access Control

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

IBM: Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated...