Reserved but Public CVEs

CVE-2026-46619 is an authentication bypass vulnerability in OpenAM Community Edition affecting versions through 16.0.6. The flaw is in the MSISDN authentication module, where insufficient neutralization of LDAP special elements allows LDAP injection during user lookup or matching. In the default trusted gateway configuration, an unauthenticated remote attacker can manipulate the MSISDN authentication flow to cause OpenAM to issue an authenticated session for an arbitrary matched user without supplying that user’s password.

CVE-2026-46619First seen Jun 27, 2026

CVE-2026-44162 affects fluent-plugin-s3. According to the provided advisory, the vulnerability is in the in_s3 input plugin, which reads the entire decompressed payload into memory without enforcing a strict size limit. A specially crafted highly compressed file can therefore expand to an excessive size during decompression, causing uncontrolled memory consumption.

CVE-2026-44162First seen Jun 27, 2026

CVE-2026-41262 is an authorization flaw in Fleet DM affecting the global policy read endpoint (`GET /api/latest/fleet/policies/{policy_id}`). The endpoint is intended to return only global policies, but insufficient authorization validation allows a user with observer-level access on any team to request arbitrary policy IDs and receive full details for policies belonging to other teams. The issue breaks intended team isolation by failing to ensure that the fetched policy is actually global or otherwise properly authorized in the context of the requesting user. According to the advisory, the recommended fix is to verify after fetch that the returned policy has `TeamID == nil` before returning it, or to re-authorize against the fetched policy object so team-scoped authorization is correctly enforced.

CVE-2026-41262First seen Jun 27, 2026

OpenAM Community Edition contains a flaw in its OAuth2 authentication/account creation flow where, on OAuth2 re-login, the module can rewrite a local user's password to the username without proper verification. This creates an authentication bypass condition for affected local accounts because the attacker can subsequently authenticate using the victim's username as both the username and password. The issue affects the OAuth2 authentication module behavior during re-login and user state handling, including cases noted in the advisory where disabled accounts may be reactivated.

CVE-2026-46623First seen Jun 27, 2026

CVE-2026-44163 is a denial-of-service vulnerability in fluent-plugin-opentelemetry affecting the in_opentelemetry HTTP input. The issue is caused by missing strict size limits on incoming HTTP requests and on decompressed payloads. As a result, an attacker can submit excessively large request bodies or crafted compressed payloads that expand significantly during decompression, leading to uncontrolled memory consumption in the Fluentd process handling OpenTelemetry ingestion.

CVE-2026-44163First seen Jun 27, 2026

CVE-2026-46371 is an observer-level information disclosure vulnerability in Fleet affecting the Apple MDM commands listing endpoint, GET /api/v1/fleet/mdm/apple/commands. According to the provided advisory, the endpoint fails to properly validate the order_key parameter used for sorting, enabling an authenticated low-privilege user with the Observer role to abuse the ORDER BY clause as an oracle. By leveraging cursor-based binary search against joined database tables, an attacker can infer and extract sensitive values that should not be exposed through this endpoint. Reported exposed data includes host enrollment secrets, node_key, orbit_node_key, and APNS tokens.

CVE-2026-46371First seen Jun 12, 2026

CVE-2026-46370 is an information disclosure vulnerability in Fleet affecting the labels host-listing endpoint. According to the provided advisory, an authenticated user with Global Observer or Team Observer privileges can abuse an ORDER BY oracle in that endpoint to infer sensitive host enrollment secrets, including node_key and orbit_node_key, one character at a time. The issue allows low-privileged observer-role users to extract secrets that should not be exposed through query behavior, indicating a side-channel/oracle condition in server-side query handling or response differentiation tied to ORDER BY processing.

CVE-2026-46370First seen Jun 12, 2026

OpenAM Community Edition contains an authorization bypass in the stateful OAuth2 token-read path. According to the provided advisory, if an attacker can place attacker-controlled JSON into the shared Core Token Store under a known identifier, OpenAM will accept that data when reading stateful OAuth2 token material, allowing minting of arbitrary OAuth2 bearer tokens and OIDC ID tokens. The forged token content can include attacker-chosen subject, client, realm, and scope values. The issue affects token validation/trust decisions in the OAuth2/OIDC flow rather than creation of a full OpenAM SSO session.

CVE-2026-46498First seen Jun 26, 2026

CVE-2026-48722 is an incorrect default permissions issue in Nextflow affecting the `auth login` workflow. On multi-user POSIX systems, the interactive `nextflow auth login` command may store a Seqera Platform OIDC/bearer token in `seqera-auth.config` under the Nextflow home directory with overly permissive filesystem permissions, making the file world-readable to other local users. The vulnerable condition is the insecure creation or retention of the token-bearing configuration file rather than a memory corruption flaw or remote code execution bug. The issue affects confidentiality of authentication material by exposing a valid platform token to unauthorized local users on the same host.

CVE-2026-48722First seen Jun 26, 2026

OpenAM Community Edition contains an unauthenticated authentication bypass in its RADIUS authentication module. The flaw allows an attacker to spoof a RADIUS Access-Accept response, causing OpenAM to treat the authentication as successful and create a valid session for an arbitrary RADIUS username. Based on the available information, exploitation does not require knowledge of the RADIUS shared secret and results in successful impersonation of a RADIUS-mapped user.

CVE-2026-46560First seen Jun 26, 2026

CVE-2026-45794 is an unsafe Java deserialization issue in OpenAM Community Edition affecting deployments through 16.0.6 that have the Push Notification Service with SNS callbacks enabled. According to the provided advisory, a low-privileged user can plant attacker-controlled data which is later processed when an anonymous SNS callback reaches the vulnerable callback resource. During that processing, the application performs attacker-influenced class loading and Jackson-driven object construction on untrusted data. This creates a server-side deserialization/object-instantiation condition with classpath-dependent exploitability and can result in arbitrary code-relevant gadget invocation, file modification, data corruption, or service instability.

CVE-2026-45794First seen Jun 26, 2026

CVE-2026-45052 is an improper authorization vulnerability in the OpenAM Liberty Web Services SOAP receiver. According to the provided advisory, the flaw allows an unauthenticated remote attacker to write persistent discovery entries into user LDAP entries and into the shared root-realm Discovery branch. The vulnerable condition appears to stem from the SOAP receiver performing writes with elevated internal privileges without enforcing the normal identity-layer ACLs that should restrict such modifications. This results in unauthorized modification of Liberty discovery data through the exposed Liberty Web Services endpoint.

CVE-2026-45052First seen Jun 25, 2026

CVE-2026-45049 is an information exposure vulnerability in OpenAM Community Edition affecting the CDSSO CDCServlet component used in cross-domain single sign-on flows. Under affected configurations, the servlet can be abused so that a logged-in user's raw OpenAM session token is included in a POST request to an attacker-controlled URL. This exposes a bearer-style session artifact outside the intended trust boundary. Based on the available information, exploitation requires inducing an authenticated victim to visit a crafted URL and is relevant to deployments with CDSSO enabled, particularly where the non-default protective configuration is absent.

CVE-2026-45049First seen Jun 24, 2026

motionEye contains a missing authorization vulnerability in the ActionHandler.post() handler. The vulnerable endpoint fails to enforce authentication/authorization checks before processing action requests, allowing unauthenticated remote attackers to invoke camera-related actions exposed through the web interface. Based on the advisory, reachable actions include taking snapshots, starting or stopping recording, and executing configured action scripts. Depending on deployment configuration, those scripts may perform PTZ movement, alarm control, lighting changes, or interact with remote camera resources.

CVE-2026-55863First seen Jun 24, 2026

OpenAM Community Edition contains an authenticated privilege escalation vulnerability in its session management endpoint. Due to insufficient authorization checks, a low-privileged authenticated user can query session information for arbitrary users rather than being limited to their own session context. The exposed session information can include active session credentials or tokens for other users. This creates an information exposure condition that can be leveraged to assume the identity of other users, including privileged accounts, and escalate privileges within the platform.

CVE-2026-45048First seen Jun 24, 2026

CVE-2026-48496 is a denial-of-service vulnerability in opentelemetry-ebpf-profiler. According to the advisory, an unprivileged process can cause the processPIDEvents goroutine to block indefinitely in the openat2 syscall while the profiler is analyzing new ELF files. This indefinite blocking prevents the profiler from continuing normal processing of newly observed ELF binaries, resulting in loss of profiling functionality in the affected agent.

CVE-2026-48496First seen Jun 12, 2026

CVE-2026-44793 is a pre-authentication reflected cross-site scripting vulnerability in OpenAM federation endpoints. According to the provided advisory, the issue is caused by inconsistent output encoding of user-supplied parameters in HTML responses. In certain non-default clustered deployment configurations, attacker-controlled input can be reflected back in the OpenAM origin and executed in a victim's browser, including via the FSUtils.postToTarget code path referenced by the advisory.

CVE-2026-44793First seen Jun 23, 2026

CVE-2026-44778 is a denial-of-service vulnerability in Inspektor Gadget's USDT note parser, specifically in ELF parsing logic used when deploying custom gadgets that use USDT probes. A crafted ELF file placed in a targeted binary or library can trigger unsafe parsing conditions, including out-of-bounds slice access and excessive memory allocation based on attacker-controlled note metadata. The vulnerable code path is in the USDT handling/parsing logic in pkg/uprobetracer/usdt.go. When the privileged Inspektor Gadget process parses the malicious ELF from an unprivileged container context, it can panic or consume enough memory to be OOM-killed.

CVE-2026-44778First seen Jun 23, 2026

motionEye contains an authentication bypass vulnerability in its web authentication design. The application trusts client-controlled cookies, specifically values such as meye_username and meye_password_hash, as authentication material. Because these cookies contain a username and a password-hash-derived value and are accepted by the server for identity validation, an attacker who knows or can obtain a valid username together with the corresponding password-hash-derived value can impersonate that user without legitimate authentication. This can include impersonation of administrative users. The issue is fundamentally caused by reliance on attacker-controlled client state for authentication decisions rather than server-side session validation.

CVE-2026-46488First seen Jun 23, 2026

CVE-2026-41573 is an LDAP injection vulnerability in the OpenAM REST API, specifically affecting user query endpoints that process the `_queryId` parameter. An authenticated attacker can supply LDAP metacharacters via this parameter, causing attacker-controlled input to be incorporated into LDAP query/filter construction without proper neutralization. This can alter the intended LDAP filter logic and enable injection against backend directory queries.

CVE-2026-41573First seen Jun 23, 2026

CVE-2026-44179 is a remote code execution vulnerability in xwiki-pro-macros affecting the excerpt-include macro. According to the provided advisory, the issue is caused by improper escaping of the included page title combined with execution of excerpt content with the macro's rights. This allows attacker-controlled content or parameters associated with the included page/excerpt processing path to be interpreted in a way that results in server-side code execution within the XWiki installation.

CVE-2026-44179First seen Jun 23, 2026

CVE-2026-44202 is an authenticated server-side request forgery (SSRF) vulnerability in OpenAM affecting org.openidentityplatform.openam:openam-core prior to 16.1.1. The issue is present in the /sessionservice endpoint due to insufficient restriction of user-registered session event notification URLs. An authenticated attacker can register or influence a notification URL such that the OpenAM server performs outbound requests to attacker-chosen destinations.

CVE-2026-44202First seen Jun 23, 2026

CVE-2026-55828 is a path traversal vulnerability in the tar extraction logic of go.qbee.io/transport. According to the provided advisory, a crafted tar archive can exploit a symlink-chain traversal condition during extraction, allowing files to be written outside the intended destination directory. The write primitive is limited by the advisory to one directory level above the intended extraction path. In deployments such as qbee-agent, where the extracting process runs with root privileges, the vulnerable behavior can lead to privileged file writes outside the designated extraction directory.

CVE-2026-55828First seen Jun 20, 2026

OpenBao contains an authorization flaw in the System Backend's handling of namespace paths. In non-root namespaces, special handling of the literal path segment "root" during namespace path canonicalization can cause requests targeting /sys/namespaces/root to resolve to the containing namespace rather than remaining confined to the caller's namespace context. As a result, an authenticated user with namespace-management capabilities on /sys/namespaces within a non-root namespace may be able to perform management operations against the parent namespace. The issue affects namespace path canonicalization logic rather than the immutable root namespace itself.

CVE-2026-55775First seen Jun 20, 2026

CVE-2026-55832 is an arbitrary file read vulnerability in the Rust tract-onnx crate when loading malicious ONNX models that use external_data. The issue stems from insufficient sanitization and validation of the external_data location field, allowing attacker-controlled path traversal. A crafted ONNX model can supply absolute paths or traversal sequences that cause the loader to resolve and read files outside the intended model directory. The provided advisory also indicates insufficient validation of external data offset and length values, which can trigger out-of-bounds handling errors and panic conditions during parsing or loading. Based on the available information, the vulnerability affects model-loading logic for ONNX external data rather than inference execution itself.

CVE-2026-55832First seen Jun 20, 2026