NVD · CVSS 7.5
WIEDZA Z SIECI
Podatności
NVD · CVSS 8.1
CVE-2026-61628 · nginx ignition is a user interface for the nginx web server.
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 2.3
CVE-2026-55870 · GoCD is a continuous deliver server.
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and password fields or secret-management plugins, legacy configuration permits credentials in material URLs, and not every mixed-use API consistently applies URL masking for every material type. An authenticated user with access to an affected pipeline can obtain credentials embedded in its material URL, while dedicated password fields remain encrypted and are not exposed by this issue. This issue is fixed in version 26.1.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 4.9
CVE-2026-55625 · GoCD is a continuous deliver server.
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipeline group administrator can invoke Test Connection for source control materials outside the administrator's authorized pipeline group or configuration repository and potentially use credentials from those materials. For GoCD 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. This issue is fixed in version 26.1.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 7.8
CVE-2026-55567 · BleachBit cleans files to free disk space and to maintain privacy.
BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 8.2
CVE-2026-55074 · Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec.
Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 8.4
CVE-2026-55071 · MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design.
MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this leads to full OS-level arbitrary command execution (RCE) under the account running the Stata-MCP server. The tool is registered in the default all profile, so no non-default configuration is required. This issue has been patched in version 1.19.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 3.7
CVE-2026-55060 · GoCD is a continuous deliver server.
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 5.3
CVE-2026-54584 · mport is the MidnightBSD Package Manager.
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 4.3
CVE-2026-52743 · GoCD is a continuous deliver server.
GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 5.1
CVE-2026-52742 · GoCD is a continuous deliver server.
GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists. A malicious pipeline group administrator can use disclosed agent registration data to connect a rogue compatible agent, which can create a higher-complexity path to receiving work or overwriting artifacts associated with other groups. Normal authenticated users are not affected, the endpoint does not modify server configuration, and deployments that restrict pipeline editing to full administrators or configuration repositories are not affected. This issue is fixed in version 26.1.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 7.5
CVE-2026-52741 · GoCD is a continuous deliver server.
GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 5.3
CVE-2026-52740 · GoCD is a continuous deliver server.
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 7.1
CVE-2026-94404 · MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change.The affected function did not p…
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user. If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps. The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page. The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP. Version affected: <2.5.47Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 8.3
CVE-2026-94401 · MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.When importing an XML file, MISP did not properly verif…
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead. If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network. The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services. Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed. Version affected: <2.5.47Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 6.3
CVE-2026-94394 · When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are al…
When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level. The vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data. The main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 6.4
CVE-2026-94393 · When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.As a result,…
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access. The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID. The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions. Version affected: <2.5.47Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 5.1
CVE-2026-94387 · Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping.
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 2.3
CVE-2026-94382 · Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on…
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.Czytaj całość ↵Źródło — otwiera w nowej karcieNVD · CVSS 8.9