PULSE
EN
FEED
ransomqilin reclama a Light Rail Manila · PH · Transportationransomakira reclama a Hudson & Hudson Sign Products · US · Manufacturingransomakira reclama a Service One Transportation · Transportationransomqilin reclama a Farmacia I · MX · Healthcareransomqilin reclama a Grupo Ciosa, SAPI de CV · MX · Otherransomqilin reclama a iFink · RO · Technologyransomqilin reclama a Innoe Asesores · MX · Professional Servicesransomaurora reclama a CP Manufacturing, Inc. · US · Manufacturingransompear reclama a Five Star Jewelers · US · Retail & E-Commerceransomdragonforce reclama a lyserp.com · Technologyransomdoommageddon reclama a A***** T******ransomrhysida reclama a INTI International University & Colleges · MY · Educationransomn0n reclama a Minutes Quick Services · AE · Professional Servicesransomsilentransomgroup reclama a Susman Godfrey LLP · US · Professional Servicesransomqilin reclama a Light Rail Manila · PH · Transportationransomakira reclama a Hudson & Hudson Sign Products · US · Manufacturingransomakira reclama a Service One Transportation · Transportationransomqilin reclama a Farmacia I · MX · Healthcareransomqilin reclama a Grupo Ciosa, SAPI de CV · MX · Otherransomqilin reclama a iFink · RO · Technologyransomqilin reclama a Innoe Asesores · MX · Professional Servicesransomaurora reclama a CP Manufacturing, Inc. · US · Manufacturingransompear reclama a Five Star Jewelers · US · Retail & E-Commerceransomdragonforce reclama a lyserp.com · Technologyransomdoommageddon reclama a A***** T******ransomrhysida reclama a INTI International University & Colleges · MY · Educationransomn0n reclama a Minutes Quick Services · AE · Professional Servicesransomsilentransomgroup reclama a Susman Godfrey LLP · US · Professional Services
← Todos los CVEs
CVE Watch30 oct 2026

CVE-2026-46499

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document op

CVSS

4.3

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 30 oct 2026 · Última mod.: 30 oct 2026 · CWE-863

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit` in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted `WebSocket` messages to execute document-mutating `UNO` commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-61789—
—
———DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment` treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in `src/tools/execute-sql.ts` validates split statements with `isReadOnlySQL`, but `src/connectors/mysql/index.ts` and `src/connectors/mariadb/index.ts` execute the original string with `multipleStatements` enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can bypass read-only mode to modify or drop database data, subject to the database account's privileges. PostgreSQL is not affected by this path because its double-dash parsing agrees with the checker and its connector executes individual split statements. This issue is fixed in version 0.22.6.2hCVE-2026-500005.0 MED
—
———SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.2hCVE-2026-1156428.3 ALT
—
———In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.2hCVE-2026-1196497.1 ALT
—
———Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().3hCVE-2026-1195734.4 MED
—
———Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.3hCVE-2026-1194144.3 MED
—
———Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.2h