CVE Notifier

CVE-2026-92893 CWE-863 4.3

Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hos…

cve.org Red · Hat:Red · Hat 6 hari lalu

CVE-2026-92894 CWE-863 4.3

Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction

A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to…

cve.org Red · Hat:Red · Hat 6 hari lalu

CVE-2026-78427 CWE-807 4.3

Admission Control Bypass via Hardcoded Sidecar Image Exemption

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the wor…

cve.org go:github.com/neuvector/neuvector 6 hari lalu

CVE-2026-78425 CWE-287 N/A

SAML Audience Confusion Allows Cross-SP Authentication

Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their s…

cve.org go:github.com/neuvector/neuvector 6 hari lalu

CVE-2026-78426 CWE-863 3.7

Logout bypass via alternate JWT spelling

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expir…

cve.org go:neuvector 6 hari lalu

CVE-2026-78428 CWE-? 8.0

Flaw in Nuevector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

cve.org go:neuvector 6 hari lalu

CVE-2026-50610 CWE-284 N/A

Improper Access control Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able …

cve.org Acer:System · Monitoring 6 hari lalu

CVE-2026-50609 CWE-284 N/A

Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local…

cve.org Acer:System · Monitoring 6 hari lalu

CVE-2026-15688 CWE-303 N/A

Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting

Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by e…

cve.org Mitsubishi · Electric · Corporation:GX 6 hari lalu

CVE-2026-50608 CWE-306 N/A

Authentication Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections…

cve.org Acer:System · Monitoring 6 hari lalu

CVE-2026-50607 CWE-668 N/A

WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service…

cve.org Acer:System · Monitoring 6 hari lalu

CVE-2026-50606 CWE-321 N/A

Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under…

cve.org Acer:System · Monitoring 6 hari lalu