CVE WatchOct 16, 2026

CVE-2026-96659

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized informa

CVSS

9.1

Critical

EPSS

0.3%

p24

KEV

—

Exploit Today

0-100

Published: Oct 1, 2026 · Last modified: Oct 16, 2026 · CWE-267

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-10-022026-10-21

Technical description

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-963904.3 MED

—

———Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.1h CVE-2026-96371—

—

———Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.14h CVE-2026-96367—

—

———Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.14h CVE-2026-96363—

—

———Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.14h CVE-2026-1095208.8 HIG

3.9%

——1A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.7d CVE-2026-188583.3 LOW

0.7%

——0IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.44d