Recent Advisories

Severity ID Title Vendor Product Date Type
LOW 3.5 CVE-2026-45266

Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling_CVE-2026-45266

Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other u...

nextcloud security-advisories < 21.1.10 CVE
LOW 3.5 CVE-2026-45159

Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner_CVE-2026-45159

Nextcloud is an open source content collaboration platform. From versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1...

nextcloud security-advisories >= 1.15.0, < 1.15.4 CVE
LOW 2.6 CVE-2026-45155

Nextcloud: Private circle can be added to another circle via API_CVE-2026-45155

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.7 and 33.0.0 to before 33.0.1, ...

nextcloud security-advisories >= 32.0.0, < 32.0.7 CVE
LOW 2.6 CVE-2026-45154

Nextcloud: Improper Access Control in Collectives_CVE-2026-45154

Nextcloud is an open source content collaboration platform. From version 2.6.0 to before version 4.3.0, when a previous collective pages was delete...

nextcloud security-advisories >= 2.6.0, < 4.3.0 CVE
LOW 2.3 CVE-2026-10275

OpenSC pkcs11-tool Key Generation pkcs11-tool.c test_kpgen_certwrite buffer overflow_CVE-2026-10275

A flaw has been found in OpenSC up to 0.26.1. This affects the function test_kpgen_certwrite of the file src/tools/pkcs11-tool.c of the component p...

n/a OpenSC 0.26.0 CVE
LOW 3.1 CVE-2026-40963

Apache Airflow: DAG authorization bypass on /ui/structure/structure_data_CVE-2026-40963

The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read...

Apache Software Foundation Apache Airflow 3.0.0 CVE
LOW 2.9 CVE-2026-10532

Logback deserialization whitelist bypass for Proxy objects_CVE-2026-10532

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Objec...

QOS.CH Sarl logback CVE
LOW 3.5 CVE-2026-48191

Wrong Permission Handling in Document Search Article Meta Filters_CVE-2026-48191

An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows ga...

OTRS AG OTRS 7.0.x CVE
LOW 3.5 CVE-2026-48190

Incorrect handling of permissions in External Interface Config Item List module_CVE-2026-48190

An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system...

OTRS AG OTRS 7.0.x CVE
LOW 2 CVE-2026-4387

Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file_CVE-2026-4387

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web ...

StrongDM StrongDM Desktop Application CVE