CVE Notifier

CVE-2026-45052 CWE-285 N/A

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and Disco…

cve.org OpenIdentityPlatform:OpenAM 15 Sep 2026

CVE-2026-44793 CWE-79 N/A

OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML i…

cve.org OpenIdentityPlatform:OpenAM 15 Sep 2026

CVE-2026-91859 CWE-778 N/A

MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a sec…

cve.org MISP:MISP 15 Sep 2026

CVE-2026-59341 CWE-? 4.2

Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal net…

cve.org Bitnami:sealed-secrets 15 Sep 2026

CVE-2026-91857 CWE-352 N/A

MISP: State-changing actions accessible via GET request enabling CSRF

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are:  - EventReportsController::purgeUnusedPictures()  - NoticelistsController::enab…

cve.org MISP:MISP 15 Sep 2026

CVE-2026-91782 CWE-476 3.3

GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference

A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation re…

cve.org GNU:Binutils 15 Sep 2026

CVE-2026-80217 CWE-912 8.8

CVE-2026-80217

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands.

cve.org LITE-ON · Technology · Corporation:FF-RFI079I4 15 Sep 2026

CVE-2026-91851 CWE-863 N/A

MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates() allowed a template when either:  - its restrict_to_permission…

cve.org MISP:MISP 15 Sep 2026

CVE-2026-77853 CWE-78 8.8

CVE-2026-77853

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane (NETCONF) may execute arbitrary OS co…

cve.org LITE-ON · Technology · Corporation:FF-RFI079I4 15 Sep 2026

CVE-2026-91826 CWE-121 4.4

CVE-2026-91826

Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations. This issue affects rLottie: 480a2ad0c…

cve.org Samsung · Opensource:rLottie 15 Sep 2026

CVE-2026-76159 CWE-732 N/A

Duplicati for Windows - Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYS…

cve.org Duplicati:Duplicati 15 Sep 2026

CVE-2026-91781 CWE-476 3.3

GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference

A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the component ELF Section Handler. The manipulation leads to nul…

cve.org GNU:Binutils 15 Sep 2026