CVE-2026-84xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
754 records · Page 2 of 8
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.
UpdatedSEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
Updated- CVE-2026-84829: Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter 8.8 High
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
Updated - CVE-2026-84828: Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token 6.5 Medium
A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluste
Updated A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, inclu
UpdatedUnauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.
Updated- CVE-2026-84819: WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.
Updated - CVE-2026-84818: WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.
Updated- CVE-2026-84814: WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability 9.8 Critical
Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.
Updated Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
Updated- CVE-2026-84811: agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode 7.1 High
agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.
Updated - CVE-2026-84810: claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan 7.1 High
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads.
Updated - CVE-2026-84809: Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode 7.1 High
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code
Updated Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
UpdatedKimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activiti
UpdatedKimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be
UpdatedKimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permis
UpdatedKimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.
UpdatedSiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
Updated- CVE-2026-84802: Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController 5.3 Medium
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
Updated - CVE-2026-84801: Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers 8.7 High
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's
Updated Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only t
UpdatedCraft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.
UpdatedCraft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-chec
Updated- CVE-2026-84797: Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate 5.3 Medium
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress cont
Updated - CVE-2026-84796: Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass 8.7 High
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.
Updated - CVE-2026-84795: Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance 9.2 Critical
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
Updated Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
UpdatedCraft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
UpdatedCraft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the desti
UpdatedZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.
UpdatedOpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
UpdatedZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope.
UpdatedZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.
UpdatedIssue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also with
UpdatedIssue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certifi
UpdatedIssue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake
UpdatedContributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
Updated- CVE-2026-84780: WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability 5.3 Medium
Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.
Updated Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.
UpdatedUnauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.
UpdatedUnauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.
Updated- CVE-2026-84776: WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability 7.5 High
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
Updated - CVE-2026-84775: WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability 5.3 Medium
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
UpdatedEditor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.
UpdatedUnauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.
UpdatedUnauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.
UpdatedUnauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
Updated- CVE-2026-84768: WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
Updated Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
Updated- CVE-2026-84766: WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability 5.9 Medium
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
UpdatedUnauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.
Updated- CVE-2026-84763: WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.
Updated - CVE-2026-84762: WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability 5.3 Medium
Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.
Updated Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
UpdatedUnauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.
UpdatedUnauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.
Updated- CVE-2026-84758: WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability 6.5 Medium
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
Updated Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
Updated- CVE-2026-84756: WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability 7.1 High
Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.
Updated - CVE-2026-84755: WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability 6.5 Medium
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
Updated - CVE-2026-84754: WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability 6.5 Medium
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
Updated - CVE-2026-84753: WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
Updated Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
UpdatedThe Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP a
UpdatedImproper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal_port is documented to make builtin services (and Tabbed services) reachable only from the internal port, and the HTTP/h2 dispatch path enforced this. However, all protobuf-based protocol dispatch paths (baidu_std,
UpdatedInterpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function FindMethodPropertyByURI() in bRPC's HTTP protocol splits the request path with a string splitter that skips empty fields, so paths containing empty path segments (co
UpdatedThe Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.
UpdatedThe WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.
UpdatedThe Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
UpdatedThe Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.
UpdatedThe Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
UpdatedThe Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
UpdatedGitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.
UpdatedThe AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.
Updated- CVE-2026-84737: Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter 9.8 Critical
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
Updated In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification. As a result, an atta
UpdatedThe Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
UpdatedRetransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow
Updated- CVE-2026-84731: Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS 9.3 Critical
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cook
Updated - CVE-2026-84727: Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message 5.4 Medium
Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message. Root Cause: When processing an RTMP Abort (protocol control message type 2), the RTMP policy implementation deleted the target RtmpChunkStream object. The send path (RtmpUnsentMessage::App
Updated when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
UpdatedAn argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens the management-command argument list into a single string with spaces before the job runner re-splits it
UpdatedA server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an internal, loopback, link-local, or reserved address. An authenticated user with organization notification-
UpdatedA flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column
UpdatedA flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permiss
UpdatedA flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for th
UpdatedA flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote atta
UpdatedA flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS subject-alternative-name, and recep
Updated- CVE-2026-84715: FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update 8.7 High
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enabling unauthorized access to sensitive data, backups, and server configuration.
Updated A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accep
UpdatedA flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint i
Updated