CVE-2026-110804
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenti
CVSS
4.3
Medio
EPSS
0.2%
p7
KEV
—
Exploit Today
2
0-100
Publicado: 16 oct 2026 · Última mod.: 16 oct 2026 · CWE-915
0.2%EPSS · 30 días0.2%
2026-10-172026-10-19
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-112239——
———The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.10hCVE-2026-1123058.8 ALT—
——0Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.1dCVE-2026-1122955.4 MED—
——0FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.23hCVE-2026-978585.3 MED16.1%
——5An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.4dCVE-2026-77470—37.9%
——11Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.5dCVE-2026-1089485.4 MED18.1%
——5A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.5d