CVE-2026-106475

Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials

The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Grafana

Products

Elasticsearch Datasource Grafana Grafana Enterprise

CVE-2026-120146

PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks

Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-12977

Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation

A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Fuze 7 Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack and 4 more

CVE-2026-104619

PackageKit ZYpp rollback vulnerability

Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Packagekit

Products

Packagekit

CVE-2026-113374

Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation

Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Sonatype

Products

Nexus Repository Manager

CVE-2026-117635

Gitea admin API public-only token scope bypass

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-114524

Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Custom Formatters

CVE-2026-120450

LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Laradashboard

Products

Lara Dashboard

CVE-2026-117614

jenkins: jenkins: Arbitrary code execution via legacy agent launch command conversion

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Jenkins Project

Products

Jenkins Jenkins

CVE-2026-117620

jenkins: jenkins: Privilege escalation via Manage Old Data feature

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Jenkins Project

Products

Jenkins Jenkins

CVE-2026-105608

Consul vulnerable to an authorization bypass in service mesh registration

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Consul Consul Enterprise

CVE-2026-96363

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-59386

Credential exposure to space supporter

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Cf-deployment Cloud Controller

CVE-2026-57202

Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Asterisk

Products

Asterisk Certified Asterisk

CVE-2026-101786

mysql: mysql: Server takeover by a privileged network attacker

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Mysql Cluster Mysql Server

CVE-2026-96371

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-96367

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform

CVE-2026-96390

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Editoria11y Accessibility Checker

CVE-2026-67233

RabbitMQ: Monitoring-tag user can DELETE shovels

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2 delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. But allowed_methods includes DELETE, and delete_resource/2 deletes / restarts shovel runtime parameters with no additional role check. A monitoring user , intended to have read-only visibility , can therefore delete or restart any shovel in any vhost they can see. A read-only monitoring user can delete or restart any dynamic shovel , a state-changing operation that the equivalent /api/parameters endpoint correctly restricts to policymaker. Preconditions include rabbitmq_shovel + rabbitmq_shovel_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Rabbitmq

Products

Rabbitmq Server Rabbitmq-server

CVE-2026-96659

Foreman: excessive permissions for viewer role on preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Redhat Theforeman

Products

Enterprise Linux Satellite Satellite Capsule and 2 more