PT-2026-63480

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with write access and the ability to run aggregation queries can cause a mongod process to be terminated by the operating system. This occurs due to disproportionate...

PT-2026-67364

Impact The Postgres Trigger node interpolated user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping, so an authenticated user could inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential...

CVE-2026-60351

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: ADF Faces. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper...

EUVD-2026-41636

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...

GHSA-W5PG-649R-P6GG Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...

PT-2026-62146

Name of the Vulnerable Software and Affected Versions Oracle Utilities Network Management System versions 2.5.0.1.0 through 2.5.0.1.17 Oracle Utilities Network Management System versions 2.5.0.2.0 through 2.5.0.2.11 Oracle Utilities Network Management System versions 2.6.0.1.0 through 2.6.0.1.12...

EulerOS Virtualization 2.10.0 : libcap (EulerOS-SA-2026-2856)

According to the versions of the libcap package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the...

CVE-2026-55550

NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...

CVE-2026-55544

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

BIT-NGINX-AGENT-2026-60062 NGINX Agent Vulnerability

The NGINX Agent configdirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The configdirs directive required for this issue can also be configured through NGINX Instance Manager. A successful exploit may allow a...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-15783

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs,...

CVE-2026-15783 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs,...

CVE-2026-15783

CVE-2026-15783 (GitHub Enterprise Server) describes a missing authorization flaw where an authenticated user with write access to any repository could read metadata from private repositories they should not access. The attack path involves a delegated bypass endpoint that resolves a rule suite fr...

CVE-2026-15783

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs,...