| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server.
The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action. |
| The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken's administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.
This issue has been fixed in version 6.5.9. |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker may be able to cause unexpected system termination or read kernel memory. |
| A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination. |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash. |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
| Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-05 |
