Explore CVE records

NonePublished 26 Mar 2026, 20:23 WIB

CVE-2026-33343

etcd: Nested etcd transactions bypass RBAC authorization checks

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested transactions to bypass all key-level authorization. This allows any authenticated user with direct access to etcd t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:25 WIB

Official record

NonePublished 26 Mar 2026, 06:57 WIB

CVE-2026-30892

Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

NonePublished 20 Mar 2026, 04:21 WIB

CVE-2026-32752

FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v3.1KEVNot listedEPSSPresentUpdated21 Mar 2026, 01:10 WIB

Official record

NonePublished 19 Mar 2026, 01:13 WIB

CVE-2026-3479

pkgutil.get_data() does not enforce documented restrictions

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 05:01 WIB

Official record

NonePublished 14 Mar 2026, 04:43 WIB

CVE-2026-32732

XSS in @leanprover/unicode-input-component

Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. The issu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 03:22 WIB

Official record

NonePublished 14 Mar 2026, 00:42 WIB

CVE-2026-31897

FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when SrcSize is 0. The function dereferences *srcp (which points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL, this r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 01:10 WIB

Official record

NonePublished 13 Mar 2026, 00:20 WIB

CVE-2026-31873

Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes('data:') returns false.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v3.1KEVNot listedEPSSPresentUpdated13 Mar 2026, 00:46 WIB

Official record

NonePublished 12 Mar 2026, 02:21 WIB

CVE-2026-31954

Emlog asynchronous media file deletion missing CSRF protection

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

Excerpt language: en.

CVSS0v3.1KEVNot listedEPSSPresentUpdated13 Mar 2026, 03:01 WIB

Official record

NonePublished 07 Mar 2026, 12:13 WIB

CVE-2026-30825

hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.

Excerpt language: en.

CVSS0v3.1KEVNot listedEPSSPresentUpdated10 Mar 2026, 03:42 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage