CVE Notifier

CVE-2026-82685 CWE-639 N/A

Confirmation token accepted on any record in AshAuthentication

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A co…

cve.org team-alembic:ash_authentication · team-alembic:ash_authentication 5 hari lalu

CVE-2026-82760 CWE-407 N/A

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.B…

cve.org team-alembic:ash_authentication · team-alembic:ash_authentication 5 hari lalu

CVE-2026-82759 CWE-760 N/A

Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant t…

cve.org team-alembic:ash_authentication · team-alembic:ash_authentication 5 hari lalu

CVE-2026-82723 CWE-532 N/A

Actor record with password digest stored in AshAuthentication audit log entries

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The audit_log add-on builds each entry's extra_d…

cve.org team-alembic:ash_authentication · team-alembic:ash_authentication 5 hari lalu

CVE-2026-92904 CWE-863 4.3

Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocation…

cve.org Red · Hat:Red · Hat 5 hari lalu

CVE-2026-92932 CWE-918 N/A

MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $opti…

cve.org misp:sachertortephp 5 hari lalu

CVE-2026-92921 CWE-916 4.9

admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionar…

cve.org cjbi:admin3 5 hari lalu

CVE-2026-92920 CWE-613 5.4

admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued bef…

cve.org cjbi:admin3 5 hari lalu

CVE-2026-92919 CWE-22 8.1

admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments…

cve.org cjbi:admin3 5 hari lalu

CVE-2026-92918 CWE-532 8.8

admin3 through 3.0.0 Session Token Disclosure via Audit Log

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harve…

cve.org cjbi:admin3 5 hari lalu

CVE-2026-81481 CWE-22 7.5

CVE-2026-81481

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access c…

cve.org Dell:OpenManage · Server · Administrator 5 hari lalu

CVE-2026-81480 CWE-121 7.2

CVE-2026-81480

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading …

cve.org Dell:OpenManage · Server · Administrator 5 hari lalu