CVE Notifier

CVE-2026-92763 CWE-862 8.1

Rundeck through 6.2.1 Authorization Bypass via Project Import

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files i…

cve.org rundeck:rundeck 6 hari lalu

CVE-2026-92762 CWE-862 8.8

Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire sta…

cve.org pelican:panel 6 hari lalu

CVE-2026-92761 CWE-862 8.8

WebVirtCloud Missing Authorization on Instance Control Actions

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root password…

cve.org retspen:webvirtcloud 6 hari lalu

CVE-2026-92760 CWE-863 6.5

Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the…

cve.org shlinkio:shlink 6 hari lalu

CVE-2026-92759 CWE-522 6.5

SecObserve before 1.59.1 Information Disclosure via API Configuration

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product me…

cve.org SecObserve:SecObserve 6 hari lalu

CVE-2026-92754 CWE-862 4.3

PatrowlManager through 1.8.4 Improper Access Control via users API

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can …

cve.org Patrowl:PatrowlManager 6 hari lalu

CVE-2026-92753 CWE-862 7.1

PatrowlManager through 1.8.4 Authorization Bypass via Events API

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary …

cve.org Patrowl:PatrowlManager 6 hari lalu

CVE-2026-92752 CWE-639 8.3

metasfresh Unauthorized Access via Document Attachments and Comments Endpoints

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers …

cve.org metasfresh:metasfresh 6 hari lalu

CVE-2026-92751 CWE-352 8.1

CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destru…

cve.org yahoo:CMAK 6 hari lalu

CVE-2026-92750 CWE-862 6.5

Harness through 3.3.0 Missing Access Control via infraproviders endpoint

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query …

cve.org harness:harness 6 hari lalu

CVE-2026-92749 CWE-338 8.1

SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the i…

cve.org chaitin:SafeLine 6 hari lalu

CVE-2026-92748 CWE-22 8.8

BC Security Empire before 6.7.1 Path Traversal File Upload RCE

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversa…

cve.org BC-SECURITY:Empire 6 hari lalu