CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-70463

rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-72792

SiYuan before v3.7.4 Information Disclosure via Tag API

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document's publish password.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-72788

SiYuan before v3.7.4 Information Disclosure via UILayout Filter

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-70452

rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-67347

Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or Asset entities from different channels to overwrite inventory locations or catalog assets belonging to other tenants without proper channel isolation validation.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Vendure

Products

Vendure

CVE-2026-58139

DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Duckdb

Products

Duckdb

CVE-2026-19345

code-projects Task Management System UpdateTaskStatus.php authorization

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Task Management System

CVE-2026-72859

Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Budibase

Products

Budibase Server

CVE-2026-62872

.NET Framework Elevation of Privilege Vulnerability

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Windows 10 1607 and 12 more

CVE-2026-43001

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Openstack

Products

Keystone

CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-73652

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted for approval. No fixed version is available as of this review.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vantage6

Products

Vantage6

CVE-2026-57897

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-45808

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openbao

Products

Openbao

CVE-2026-24791

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-48375

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-73265

RustFS: Version-specific object reads authorize the non-version action

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Rustfs

Products

Rustfs

CVE-2026-25652

ColdFusion | Incorrect Authorization (CWE-863)

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-72921

SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Seaweedfs

Products

Seaweedfs