Authorization-bypass

4 posts tagged with “Authorization-bypass”

CVE-2026-75033: one Rancher annotation copies another cluster's secrets
cverancherkubernetes

CVE-2026-75033: one Rancher annotation copies another cluster's secrets

How to fix CVE-2026-75033: upgrade Rancher to 2.15.1, 2.14.5, 2.13.9, or 2.12.13, and move rancher-webhook with it.

Sep 3, 2026
Read
BREAKING: CVE-2026-18432 - Frontend Admin WordPress Unauthenticated Admin Takeover
cvesecurityvulnerability

BREAKING: CVE-2026-18432 - Frontend Admin WordPress Unauthenticated Admin Takeover

CVE-2026-18432 is a CVSS 9.8 privilege-escalation flaw in Frontend Admin by DynamiApps that can let unauthenticated attackers reset the default WordPress administrator account. Update to 3.29.10.

Aug 16, 2026
Read
BREAKING: CVE-2026-19598 - Pods WordPress Plugin Unauthenticated Admin Takeover
cvesecurityvulnerability

BREAKING: CVE-2026-19598 - Pods WordPress Plugin Unauthenticated Admin Takeover

CVE-2026-19598 is a CVSS 9.8 authorization bypass in the Pods WordPress plugin that lets unauthenticated attackers reach admin methods and take over sites. Update to 3.3.9.1.

Aug 16, 2026
Read
CVE-2026-12624: HashiCorp Vault LIST Authorization Bypass via Trailing Slash
cvesecurityvulnerability

CVE-2026-12624: HashiCorp Vault LIST Authorization Bypass via Trailing Slash

CVE-2026-12624 lets a Vault token enumerate secrets beneath a path a deny policy was supposed to block. The ACL engine failed to enforce wildcard deny rules on LIST requests with a trailing slash. Fixed in Vault 2.0.3.

Aug 12, 2026
Read