๐จ CVE-2026-10697
Improper Authentication vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
๐@cveNotify
Improper Authentication vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
๐@cveNotify
Progress
Fixed Issues in 2026.0.3
This section outlines issues tracked and fixed by the MOVEit product team for the 2026.0.3 Service Pack. Note: See the What's New section for a broader summary of features and improvements.
๐จ CVE-2026-15630
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
๐@cveNotify
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
๐@cveNotify
Voke Cyber
CVE-2026-15630 โ Cross-Tenant Authorization Bypass in Casdoor IAM (CVSS 9.6 Critical)
CVSS 9.6 cross-tenant authorization bypass in Casdoor. The authz filter checks the URL ?id= while the controller acts on the body, so any org admin can reach every other tenant. No fix. Reported by Voke Cyber.
๐จ CVE-2026-15966
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
๐@cveNotify
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
๐@cveNotify
Progress
Fixed Issues in 2026.0.3
This section outlines issues tracked and fixed by the MOVEit product team for the 2026.0.3 Service Pack. Note: See the What's New section for a broader summary of features and improvements.
๐จ CVE-2026-15967
Insufficient session expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
๐@cveNotify
Insufficient session expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
๐@cveNotify
Progress
Fixed Issues in 2026.0.3
This section outlines issues tracked and fixed by the MOVEit product team for the 2026.0.3 Service Pack. Note: See the What's New section for a broader summary of features and improvements.
๐จ CVE-2026-15968
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
๐@cveNotify
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
๐@cveNotify
Progress
Fixed Issues in 2026.0.3
This section outlines issues tracked and fixed by the MOVEit product team for the 2026.0.3 Service Pack. Note: See the What's New section for a broader summary of features and improvements.
๐จ CVE-2026-15981
The SAML Single Sign On โ SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error โ bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
๐@cveNotify
The SAML Single Sign On โ SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error โ bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
๐@cveNotify
๐จ CVE-2026-16002
The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.
๐@cveNotify
The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.
๐@cveNotify
๐จ CVE-2026-16796
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
To mitigate this issue, users should upgrade to the patched version 1.18.1.
๐@cveNotify
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
To mitigate this issue, users should upgrade to the patched version 1.18.1.
๐@cveNotify
๐จ CVE-2026-21653
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.
This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.
๐@cveNotify
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.
This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.
๐@cveNotify
Johnsoncontrols
Security Advisories
Check out the listed Security Advisories (SA) about identified security vulnerabilities in Johnson Controls' products and the mitigation measures taken.
๐จ CVE-2026-34496
Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233.
This issue affects victor Web: before 7.1.
๐@cveNotify
Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233.
This issue affects victor Web: before 7.1.
๐@cveNotify
Johnsoncontrols
Security Advisories
Check out the listed Security Advisories (SA) about identified security vulnerabilities in Johnson Controls' products and the mitigation measures taken.
๐จ CVE-2026-38764
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys
๐@cveNotify
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys
๐@cveNotify
๐จ CVE-2026-39155
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to synthesize negative answers for legitimate names and causing resolver-side denial of service.
๐@cveNotify
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to synthesize negative answers for legitimate names and causing resolver-side denial of service.
๐@cveNotify
www.knot-dns.cz
Version 3.4.10 โ Knot DNS
High-performance authoritative DNS server
๐จ CVE-2026-47723
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy` returns zero matches across the codebase. Version 0.3.1 fixes the issue.
๐@cveNotify
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy` returns zero matches across the codebase. Version 0.3.1 fixes the issue.
๐@cveNotify
GitHub
fix(http): add security response headers middleware (#125) ยท forgekeep/nebula-mesh@b45fda5
Wrap the top-level mux with a middleware that sets CSP, X-Frame-Options,
X-Content-Type-Options, Referrer-Policy, and HSTS (TLS-only) on every
response. Closes GHSA-w7w5-5gcp-38rw.
CSP keeps &...
X-Content-Type-Options, Referrer-Policy, and HSTS (TLS-only) on every
response. Closes GHSA-w7w5-5gcp-38rw.
CSP keeps &...
๐จ CVE-2026-47724
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access โ instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.
๐@cveNotify
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access โ instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.
๐@cveNotify
GitHub
fix(api): re-check operator status in admin authz gates (#147) ยท forgekeep/nebula-mesh@9d8bcd7
bearerAuth captures the operator into r.Context() on request entry;
downstream actorIsAdmin(ctx) gates read that snapshot for the duration
of the request. If another admin runs DisableOperator on t...
downstream actorIsAdmin(ctx) gates read that snapshot for the duration
of the request. If another admin runs DisableOperator on t...
๐จ CVE-2026-49035
The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.
๐@cveNotify
The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.
๐@cveNotify
๐จ CVE-2026-50032
A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.
๐@cveNotify
A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.
๐@cveNotify
๐จ CVE-2026-50039
The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request.
๐@cveNotify
The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request.
๐@cveNotify
๐จ CVE-2026-50103
A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.
๐@cveNotify
A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.
๐@cveNotify
๐จ CVE-2026-52439
An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism
๐@cveNotify
An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism
๐@cveNotify
Gitee
้ฒ.ๅคง่ต(ๆๅฎถๆบ)/Beetl: Beetl3.0,ๆจกๆฟๅผๆใไป2010ๅนดๅผๅง็ ๅๅผๆบ
๐จ CVE-2026-6924
A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated.
๐@cveNotify
A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated.
๐@cveNotify
GitHub
GitHub - SiliconLabs/matter: Matter is creating more connections between more objects, simplifying development for manufacturersโฆ
Matter is creating more connections between more objects, simplifying development for manufacturers and increasing compatibility for consumers, guided by the Connectivity Standards Alliance. - Sili...
๐จ CVE-2020-19909
Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.
๐@cveNotify
Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.
๐@cveNotify
daniel.haxx.se
CVE-2020-19909 is everything that is wrong with CVEs
This is a story consisting of several little building blocks and they occurred spread out in time and in different places. It is a story that shows with clarity how our current system with CVE Ids and lots of power given to NVD is a completely broken system.โฆ