| CVE-2026-71465 | RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern. | low | 2026-09-24 |
| CVE-2026-71464 | LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scm_branch. Currently blocked at runtime by jobs.py:1502 ValueError check (defense-in-depth), but the API validation gap means sole reliance on a task-layer guard. Refactoring that guard away would promote this to RCE. | low | 2026-09-24 |
| CVE-2026-71463 | Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the test-render (stub has small job.id). At runtime, the gated branch executes and exceptions write full tracebacks into notification body, which is POSTed to attacker-controlled webhook URL. Leaks install paths, Python version, source line numbers. | low | 2026-09-24 |
| CVE-2026-71462 | StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin. | medium | 2026-09-24 |
| CVE-2026-71461 | HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors. | medium | 2026-09-24 |
| CVE-2026-71460 | /api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) returned to any authenticated user. The superuser/auditor gate only covers project_base_dir/project_local_paths/custom_virtualenvs, not license_info. Enables social engineering against Red Hat support and estate sizing reconnaissance. | medium | 2026-09-24 |
| CVE-2026-71459 | JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403. | medium | 2026-09-24 |
| CVE-2026-71458 | URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No <Model> matches..." reveals whether a named resource (org, credential, inventory, host) exists anywhere on the platform. Enables cross-tenant internal hostname enumeration. | medium | 2026-09-24 |
| CVE-2026-71353 | Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-71352 | Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manager allows an authorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-71351 | Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-71350 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. | medium | 2026-09-24 |
| CVE-2026-71349 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. | medium | 2026-09-24 |
| CVE-2026-71348 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. | medium | 2026-09-24 |
| CVE-2026-71345 | Out-of-bounds write in Windows Spaceport.sys allows an authorized attacker to execute code locally. | high | 2026-09-24 |
| CVE-2026-71343 | Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to execute code locally. | high | 2026-09-24 |
| CVE-2026-71342 | Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-71341 | Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to disclose information locally. | medium | 2026-09-24 |
| CVE-2026-71339 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | medium | 2026-09-24 |
| CVE-2026-71338 | Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally. | medium | 2026-09-24 |
| CVE-2026-71336 | Integer overflow or wraparound in Windows Work Folder Service allows an authorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-71334 | Heap-based buffer overflow in Windows NFS Portmapper allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-71333 | Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-71330 | Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network. | high | 2026-09-24 |
| CVE-2026-71329 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack. | medium | 2026-09-24 |
| CVE-2026-71290 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue. | critical | 2026-09-24 |
| CVE-2026-70637 | LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service. | high | 2026-09-24 |
| CVE-2026-70622 | tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker. | high | 2026-09-24 |
| CVE-2026-70616 | boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server's file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users. | high | 2026-09-24 |
| CVE-2026-70615 | boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates. | high | 2026-09-24 |
| CVE-2026-70587 | Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. | high | 2026-09-24 |
| CVE-2026-70586 | Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to execute code over a network. | high | 2026-09-24 |
| CVE-2026-70585 | Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally. | high | 2026-09-24 |
| CVE-2026-70582 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | medium | 2026-09-24 |
| CVE-2026-70579 | Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker to disclose information over a network. | high | 2026-09-24 |
| CVE-2026-70578 | Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-70577 | Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-70575 | Null pointer dereference in Windows Schannel allows an authorized attacker to deny service over a network. | medium | 2026-09-24 |
| CVE-2026-70574 | Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-70570 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | high | 2026-09-24 |
| CVE-2026-70568 | Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-70565 | Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-70564 | Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-70563 | Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | high | 2026-09-24 |
| CVE-2026-70562 | Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | high | 2026-09-24 |
| CVE-2026-70561 | TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation. | high | 2026-09-24 |
| CVE-2026-70560 | Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a low-privileged role such as Cashier can submit a leave request through the HRM/Leave module, causing the unsanitized first-name markup to execute in the browser session of any higher-privileged user who views the leave-application notification pane, enabling cross-user session compromise within the admin origin. | medium | 2026-09-24 |
| CVE-2026-70559 | Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a stock v1.2.5 install) with one parameterless GET. Only one credential field (sys.maven.settings.repositoryPassword) has a desensitization handler wired; the other credential-bearing fields (sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token) return in cleartext. A bare install leaks the shipped defaults, including the hardcoded dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin OSS keys; once an operator configures LDAP, object storage, or DolphinScheduler through the Settings Center, those live third-party credentials leak from the same endpoint. Because dinkyToken is the sole gate on the sibling POST /download/uploadFromRsByLocal arbitrary file write, this disclosure defeats token rotation as a mitigation for that vulnerability. Affects Dinky v1.2.5 (the current release, 2025-11-05) and the development branch (dev HEAD 63b5a5a), where the affected code is byte-identical. | high | 2026-09-24 |
| CVE-2026-70557 | diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck(), returns true unconditionally, so any authenticated user (including a zero-role account) can read @JsonIgnore-annotated secret fields such as IamAccount.authSecret and IamAccount.secretSalt for every account, or arbitrary secret fields of any other entity. Shiro's two-iteration MD5 with an 8-character salt is trivially crackable offline, so the disclosed admin password hashes convert to full administrative takeover. The endpoint is not example code; the official diboot-admin-ui frontend requires it, so deployments following the vendor's recommended integration expose it. The mechanism was renamed relatedData* to attachMore* on the development branch, but attachMoreSecurityCheck() also returns true unconditionally. | high | 2026-09-24 |
| CVE-2026-70556 | Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without CSRF token or Origin/Referer validation. Attackers can craft a malicious HTML form that autosubmits attacker-chosen OAuth2 parameters including client_id, client_secret, redirect_uri, and scope to silently register a persistent OAuth2 application, enabling interception of future OAuth2 authorization codes when the victim later authenticates against the attacker-controlled client. | medium | 2026-09-24 |
