CVE-2026-28314

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-28313

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-28312

SolarWinds Serv-U Privilege Escalation Vulnerability

SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-28310

SolarWinds Serv-U Privilege Escalation Vulnerability

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-28309

SolarWinds Serv-U Broken Access Control Vulnerability

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-16607

Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Fujitsu

Products

Linux Openft Oracle Solaris Openft

CVE-2026-16606

Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Fujitsu

Products

Linux Openft Oracle Solaris Openft

CVE-2026-16486

SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Class And Exam Timetabling System

CVE-2026-28308

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-44191

Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation leads to remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially resulting in a complete system compromise.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-28307

SolarWinds Serv-U Privilege Escalation Vulnerability

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-9499

Out-of-bounds read in QTextCodec::codecForName() in Qt

An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-28302

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-49092

Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-56816

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netty

Products

Netty

CVE-2026-65015

n8n before 2.30.1 Privilege Escalation via run_node_tool

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-28305

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-28306

SolarWinds Serv-U Privilege Escalation Vulnerability

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2026-16544

Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-60080

Apache Fory: Rust MetaString heap use-after-free

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Fory